Harvester is not processing data. java.lang.IndexOutOfBoundsException in Harvester wrapper logs

Document ID : KB000005177
Last Modified Date : 14/02/2018
Show Technical Document Details
Issue:

Harvester stopped processing of data. NFA Admin page below "Repaer Timestamp" errors on harvester. Errors in harvester wrapper shows below errors:


INFO | jvm 1 | 2017/01/02 16:40:55 | 4:40:55 PM - [WARNING ] - Invalid flow! numFieldsSet=0 FLOW src=0.0.0.0:0 dst=0.0.0.0:0 bytes=0

INFO | jvm 1 | 2017/01/02 16:40:57 | java.lang.IndexOutOfBoundsException
INFO | jvm 1 | 2017/01/02 16:40:57 | at java.nio.Buffer.checkIndex(Unknown Source)
INFO | jvm 1 | 2017/01/02 16:40:57 | at java.nio.HeapByteBuffer.getShort(Unknown Source)
INFO | jvm 1 | 2017/01/02 16:40:57 | at com.ca.im.ra.util.ByteArrayUtility.getUShort(ByteArrayUtility.java:34)
INFO | jvm 1 | 2017/01/02 16:40:57 | at com.ca.im.ra.flow.netflow.NetflowParser2.parseV9OptionsTemplateSet(NetflowParser2.java:359)
INFO | jvm 1 | 2017/01/02 16:40:57 | at com.ca.im.ra.flow.netflow.NetflowParser2.parseFlowSet(NetflowParser2.java:242)
INFO | jvm 1 | 2017/01/02 16:40:57 | at com.ca.im.ra.flow.netflow.NetflowParser2.parse(NetflowParser2.java:126)
INFO | jvm 1 | 2017/01/02 16:40:57 | at com.ca.im.ra.flow.FlowParser.parseDatagram(FlowParser.java:198)
INFO | jvm 1 | 2017/01/02 16:40:57 | at com.ca.im.ra.flow.FlowParser.parseDatagram(FlowParser.java:168)
INFO | jvm 1 | 2017/01/02 16:40:57 | at com.ca.im.ra.flow.FlowParser.parseDatagram(FlowParser.java:151)
INFO | jvm 1 | 2017/01/02 16:40:57 | at com.ca.im.ra.flow.tools.FlowProcessor.execute(FlowProcessor.java:112)
INFO | jvm 1 | 2017/01/02 16:40:57 | at com.ca.im.ra.flow.tools.FlowProcessor.run(FlowProcessor.java:72)
INFO | jvm 1 | 2017/01/02 16:40:57 | at java.lang.Thread.run(Unknown Source)
INFO | jvm 1 | 2017/01/02 16:40:57 | 4:40:57 PM - [SEVERE ] - Parse Exception

Environment:
NFA 9.2.1 and 9.3.0.Distributed and standalone setup.
Cause:

The cause of this problem is because of options template not supported by NFA.

 

Resolution:

This issue is fixed in 9.3.3 and later versions. Until you upgrade your environment to 9.3.3 or later to fix this, remove the command on router that enables options template.

A typical command on Cisco routers would look like:

option exporter-stats timeout 60

Remove this on all the routers that are sending options template.

You can check which routers are sending options template by running Wireshark on problematic harvester and decoding the packets as netflow fileds.

Following the below techdoc for details on how to decode packets in Wireshark:

https://www.ca.com/us/services-support/ca-support/ca-support-online/knowledge-base-articles.TEC597610.html

Additional Information: