Verify Data Collection in a Two-Tier Distributed Deployment

Document ID : KB000048066
Last Modified Date : 14/02/2018
Show Technical Document Details

Description:

This document illustrates the steps for verifying that data files are present on the CA Network Flow Analysis servers in a Two-Tier Distributed Deployment.

Solution:

Ensure that the appropriate data files are collected in a two-tier distributed deployment by verifying that Harvester servers have valid .tbn, .nfa, rpr.cmp, and .rpa15 files.

Note: If the .tbn, .nfa, rpr.cmp, and .rpa15 files files are not present, wait for an hour and check again.

Follow these steps:

  1. Verify that valid Time BIN (.tbn) files are present on the Harvester server:

    1. Log in as a user who is a member of the Administrators group.

    2. Locate the following directory on the Harvester server: <install_path>\Netflow\datafiles\HarvesterWork.

    3. Verify that the HarvesterWork directory contains files that are named <numeric_value>-<port_number>_0.tbn.inc and that the files are larger than 0 KB.

      The directory also may contain files with a .tmp extension.

    4. Repeat these steps for any additional Harvester servers.

      You know that the Harvester is receiving flow data when you see .tbn files that are larger than 0 KB.

      Note: If the Harvester is not receiving data, verify that it listens for data on the same port that was used to configure flow export from the Harvester interfaces. If the ports do not match, modify the NetflowPacketListenPort value in the Harvester database parameter_descriptions table (harvester.parameter_descriptions). For more information, see Set Up the Routers.

  2. Verify that valid NetFlow archive (.nfa) files are present on the Harvester server:

    1. Locate the following directory on the Harvester server: <install_path>\Netflow\datafiles\HarvesterArchive.

    2. Verify that the HarvesterArchive directory contains valid NetFlow archive files--that is, .nfa files that are larger than 0 KB in size.

    3. (Recommended) If you do not find valid .nfa files, complete the following troubleshooting tasks:

      • Verify that the CA NFA Harvester service is running. If the service is not running, start it.

      • Review the harvester-wrapper.log files in the following directory: <install_path>\NetFlow\Logs. If you consult with CA Support for a resolution, supply this log or refer to the errors in it.

        To change the logging level for the harvester-wrapper.log, modify the harvester.properties file at <install_path>\Netflow\bin. Change enableDebugLogging=false to enableDebugLogging=true.

    4. Repeat these steps for any additional Harvester servers.

  3. Verify that valid Compressed Reaper (.rpr.cmp) files are present on the Harvester server:

    1. Locate the following directory on the Harvester server: <install_path>\Netflow\datafiles\ReaperWork.

    2. Verify that the ReaperWork directory contains valid Reaper files--that is, .rpr.cmp files that are larger than 1 KB.

      The .rpr.cmp files are removed from the directory at 15-minute intervals.

    3. (Recommended) If you do not find valid rpr.cmp files, perform the following troubleshooting tasks:

      • Verify that the CA NFA Reaper service is running. If the service is not running, start it.

      • Review the Reaper log files (RealtimeReaperErrors<timestamp>.log files) in the <install_path>\NetFlow\Logs directory. If you consult with CA Support for a resolution, supply this log or refer to the errors in it.
        To change the logging level, modify the extended_Parameters_view of the harvester database. The logging level is set in the following property: RealTimeReaper/Error Logging_File Logging/Severity.

    4. Repeat these steps for any additional Harvester servers.

  4. Verify that valid Reaper archive (.rpa15) files are present on the Harvester server:

    1. Locate the following directory on the Harvester server: <install_path>\Netflow\datafiles\ReaperArchive15\<Router_IP_address>\<24-Hour_timestamp>.

    2. Verify that the directory contains valid Reaper archive files--that is, .rpa15 files that are larger than 0 KB in size.

      You know that the Harvester is aggregating 15-minute data when you see .rpa15 files that are larger than 0 KB.