netflow v3 stops resolving dns names

Hi Guys,

This is a known bug in 3.0 and we are addressing it. The flow correlation table will rebuild so no history lost.

 Andy

It is safe in that the FlowCorrelation table only keeps a resolution of DNS resolutions.  Once you delete it, of course, the IP addresses will not have a way to resolve in your graphs, until new NetFlows come in with those IP addresses in them.  Then the service will see that they are not in the FlowCorrelation table and will make new DNS queries.  The history will be retained, but if no new NetFlows come in for a particular IP address, then since the graphs join on the FlowCorrelation table, I believe that they won't show up until a new DNS query is made on them.  Let me come up with a better way to do this instead of truncating the table.  I should have some T-SQL  for you to run instead this evening that will do the same thing in effect, but doesn't have this type of side-effect.

Thanks,

Here is what I really suggest that you run on the NetPerfMon database instead of truncating the FlowCorrelation table..

DECLARE @CacheExpiration datetime
SELECT @CacheExpiration = dateadd(second, 1, LastCacheExpirationCheck) FROM NetFlowCorrelationState
UPDATE FlowCorrelation SET CacheExpiration = @CacheExpiration

This will cause all the DNS entries for all IP addresses to expire and the service then will start performing DNS queries against all of them.  Keep in mind that this is not a trivial task that you are forcing the service to do.  It WILL take some time to make a network called to resolve each of the IPs in the FlowCorrelation.  You can check on the service's progress by periodically running the following T-SQL:

SELECT Count(*) FROM NetFlowAddressToResolve

It will give you a count of how many more DNS queries that the service needs to make before it is finished.  Note: If you have a bunch of sources sending NetFlows at the same time, this process can take a long time.

Hope this helps!  Let me know!

Thanks,

So the values must be messed in somewhere for these dates.  Can you look in the FlowCorrelation table and look now at what the dates are for the CacheExpiration field?  (All 7 million should be the same since we ran the query)

Furthermore if you open the NetFlowCorrelationState table, what value is in there? 

What is the computer system date/time on both the Orion/NTA machine and the SQL database server?  Are they in the same timezones?

Thanks,

I'm sorry.  I took the wrong approach here.  But the best thing to do here.  (Even if you hadn't run the above T-SQL which updated the CacheExpiration dates on all those rows), is to run the following query...

INSERT INTO NetFlowAddressToResolve (IPAddress, Reason, Timestamp)
   SELECT IPAddressSort, 0, GETDATE()

   FROM FlowCorrelation WITH(NOLOCK)

Again you can check its progress with

SELECT Count(*) FROM NetFlowAddressToResolve

Thanks,