Verify Data File Collection in a Stand-Alone Configuration

Document ID : KB000048125
Last Modified Date : 14/02/2018
Show Technical Document Details

Description:

This document shows CA Network Flow Analysis administrators how to check the file systems on CA Network Flow Analysis servers to verify that data files are being collected in a Stand-Alone Configuration.

Solution:

Ensure that the appropriate data files are collected on a stand-alone system by verifying that valid tbn, .nfa, .rpr.cmp, and .rpa15 files are present.

Note: If the .tbn, .nfa, .rpr.cmp, and .rpa15 files are not present, wait for an hour and check again.

Follow these steps:

  1. Verify that valid Time BIN (.tbn) files are present:

    1. Log in as a user who is a member of the Administrators group.

    2. Locate the following directory: <install_path>\Netflow\datafiles\HarvesterWork.

    3. Verify that the HarvesterWork directory contains files that are named <numeric_value>-<port_number>_0.tbn.inc and that the files are larger than 0 KB.

      The directory also may contain files with a .tmp extension.

      You know that the stand-alone system is collecting flow data when you see .tbn files that are larger than 0 KB.

  2. Verify that valid NetFlow archive (.nfa) files are present:

    1. Locate the following directory: <install_path>\Netflow\datafiles\HarvesterArchive.

    2. Verify that the HarvesterArchive directory contains valid NetFlow archive files--that is, .nfa files that are larger than 0 KB in size.

    3. (Recommended) If you do not find valid .nfa files, complete the following troubleshooting tasks:

      1. Verify that the CA NFA Harvester service is running. If the service is not running, start it.

      2. If the Harvester is not receiving data, verify that it listens for data on the same port that was used to configure flow export from the Harvester interfaces. If the ports do not match, modify the NetflowPacketListenPort value in the Harvester database parameter_descriptions table (harvester.parameter_descriptions). For more information, see Set Up the Routers.

      3. Review the harvester-wrapper.log files in the following directory: <install_path>\NetFlow\Logs. If you consult with CA Support for a resolution, supply this log or refer to the errors in it.

        To change the logging level for the harvester-wrapper.log, modify the harvester.properties file at <install_path>\Netflow\bin. Change enableDebugLogging=false to enableDebugLogging=true.

  3. Verify that valid Compressed Reaper (.rpr.cmp) files are present:

    1. Locate the following directory: <install_path>\Netflow\datafiles\ReaperWork.

    2. Verify that the ReaperWork directory contains valid Reaper files--that is, .rpr.cmp files that are larger than 1 KB.

      The .rpr.cmp files are removed from the directory at 15-minute intervals.

    3. (Recommended) If you do not find valid rpr.cmp files, perform the following troubleshooting tasks:

      1. Verify that the CA NFA Reaper service is running. If the service is not running, start it.

      2. Review the Reaper log files (RealtimeReaperErrors<timestamp>.log files) in the <install_path>\NetFlow\Logs directory. If you consult with CA Support for a resolution, supply this log or refer to the errors in it.
        To change the logging level, modify the extended_Parameters_view of the harvester database. The logging level is set in the following property: RealTimeReaper/Error Logging_File Logging/Severity.

  4. Verify that valid Reaper archive (.rpa15) files are present:

    1. Locate the following directory: <install_path>\Netflow\datafiles\ReaperArchive15\<Router_IP_address>\<24-Hour_timestamp>.

    2. Verify that the directory contains valid Reaper archive files--that is, .rpa15 files that are larger than 0 KB in size.

      You know that the stand-alone server is collecting aggregated 15-minute data files when you see .rpa15 files that are larger than 0 KB.