I thought Netflow 3 was going to fix this.
"Stacked Chart Error: There must be at least one row...."
I am also running NTA 3 and am getting the same error.
The entire error reads "Stacked Chart Error: There must be at least one row and one numeric column, and data should be all positive or negative."
I have seen this error specifically when selecting a protocol or application and then selecting a Named Time Period that is greater than 2 Hours.
Version 3.0 includes the following fixes:
That list of fixes is great. However, I personally never saw this error until I upgraded to NTA v3.
I'm unable to reproduce. From the NTA home page, I selected an interface and from that interface page, I selected a protocol listed in the Top 5 Protocols. I changed then changed the Named Time Period to 24 hours and could not reproduce. Further from that page, I then then selected one of the Applications on the Top 5 Applications and changed its Named Time Period to 24 hours. I then set its Named Time Period to "Today". Finally I set it instead to a Relative Time Period of Last 2 days.
Does this occur maybe only when viewing data for a particular interface? Can you provide me with more detailed steps on what you do to see this issue?
Thanks,
I am happy to report that I am no longer receiving this error. I have a suspicion as to why this error may have occurred though.
When I installed NTA v3, I had to truncate the FlowCorrelation table in order to get it installed.
I suspect that I received this error until the FlowCorrelation table was re-populated.
I hope this helps you reproduce and clean up this error.
davidmaltby: Does this occur maybe only when viewing data for a particular interface? Can you provide me with more detailed steps on what you do to see this issue?
When it did occur, it was all nodes, all interfaces. Thankfully it isn't happening anymore.
I understand. Since the FlowCorrelation is the table where the traffic is associated with its endpoints, I wouldn't be surprised if charting errors occured without them.
For what it is worth, after applying SP2 I am getting this as well on switch flows, but not on router flows. All are Cisco v5...
Hi Corey,
Strange this is only happening on switches. Looks like it's NF v5 .. is it mixed switch models or all the same?
Andy
Hello Andy,
The same model. The switches we currently have with NetFlow enabled are two 6509s with redundant Sup720s…
-Corey
If you could call into support and use WireShark to capture a sniffer trace that contains the flows from these switches and send us the PCAP file, then we can see what is happening. Make sure to indicate the IP addresses of these two switches so we can identify them in the sniffer trace.
I am also receiving this error. Currently, we only have routers configured for NetFlow. I've seen it on a few of the nodes detail pages as well as ethernet interface details page. I'm not sure if this is related or not, but on one node, I've also received an error on the nodes detail page under Top 5 Converstaions (Last 2 Hours) stating "Failure retrieving data - refresh your browser (F5) to try again. If the problem persists, see C:\InetPub\SolarWinds\OrionWeb.log for detailed information." We're still in the process of implementing NTA, so we're still configuring nodes for NetFlow. The only recent change made (aside from adding nodes) is I increased the retention time for uncompressed yesterday morning. I increased it from 1 hour to 2 hours. I began seeing the stacked chart errors yesterday afternoon. I opened a support case this morning (#51197). The details from the OrionWeb.log are in the case ticket.
Support told me this afternoon that this software bug will be fixed in SP3, tentatively due out at the end of next week. They have a pre-release version that you can get from support if you can't wait for the final release.
Just applied SP 3 and still get the error.
Since the readme states "Note: This service pack does not fix incorrect data that is already in the database." would it be advisable to truncated the FlowCorrelation table?
JB
The SP does not clean up the old data so you could truncate to get rid of it or just let it age out.
Its not the FlowCorrelation table that is causing the issue. It is the data in the NetFlowDetail_X and NetFlowSummaryX tables. If you look at the values in the TotalBytes column, for all of these tables, you'll see that some of them are negative. That is the cause of the problem.
To find out which tables have these negative number do a
UPDATE NetFlowDetail_6 SET TotalBytes = 4294967296 + TotalBytes WHERE TotalBytes < 0
NOTE: This is an untested fix, so using it may invalidate the value of the TotalBytes field. I did some basic testing myself which looked good. So backup your database before doing this UPDATE in case you need those values later.
Unfortunately, I don't have time at the moment to write some T-SQL to enumerate all the Details tables for you, but hopefully it won't be too much work for you to find and fix these values. If nothing else, this should get you started in the right direction.
Let us all know how it turns out for you.
Thanks Dave, worked like a charm.