DaveStraley Posted: Fri, May 8 2009 5:03 PM

rated by 0 users

We have just recently purchased Orion and NTA for our network and we have come across an issue with the software and Procurve switches.

  We noticed that while monitoring a limited number of ports on a given switch the sflow was either severely lacking or nonexistent.  We brought this to Solarwinds attention and this was their response...

As per our phone con - your issue is a known issue and it is by design.
 
The way the NetFlow Module currently works is that you must enable all interfaces on a node in Orion.
 
The recommended work-around for you is to upgrade to the SLX (unlimited licenses) for Orion and NetFlow; and then enable all interfaces in your network.
 
I understand that even in an extreme case scenario such as yours with 100's of interfaces per device, this is currently the only way this will work.

This is a Major issue with our network since we have over 100 remote sites and really only care about what traverses the WAN link on those sites.  What compounds the problem is that the vast majority of our sites have HP Procurve 5400's at the core with between 144-288 ports per device.  So if we want to get accurate sflow data from one WAN port we have to potentially monitor 288 interfaces.  Worse case scenario we can’t even do 7 switches fully monitored unless we use the unlimited license when we really only want 7 ports on 7 switches.  (2016 nodes vs. 14)

  I am hoping SolarWinds will correct this soon but only time will tell.

mcbridea replied on Wed, May 20 2009 4:04 PM

rated by 0 users

Hi Dave,

I am addressing this issue so that you won't have to have all interfaces monitored in Orion for these user switches to see Flows from the uplink. We're just looking at what it takes to fix it now so no date to share.

Andy

kjmartin replied on Fri, May 29 2009 9:34 AM

rated by 0 users

Are you saying that to see all of the data traversing a port on a HP switch I need to setup sFlow monitoring on all of the ports? Could this be why I only see a limited amout of data about the traffic traversing the port unless I activate mirroring on the port that I would like to monitor. You can see below what happens when I mirrored this port to another port.

mcbridea replied on Fri, May 29 2009 9:41 AM

rated by 0 users

The issue today is all the other ports need to be managed in Orion. I'm addressing that requirement. You should be able to sflow the downlink port only and see all the traffic involved whith that switch when we make that change.

kjmartin replied on Fri, May 29 2009 9:58 AM

rated by 0 users

I am curious as to why adding mirroring portion appears to fix the issue.

mcbridea replied on Fri, May 29 2009 10:34 AM

rated by 0 users

I'm not sure why that helps either.

DaveStraley replied on Fri, May 29 2009 10:35 AM

rated by 0 users

Thats great news Andy, hopefully its nothing too major.

Now we are only looking for information that traverses a particular interface, is that what you are looking to correct?  Information that is local to that network isn't really needed information for us. 

  If we can get Sflow stats to match the amount of data that shows on the interface statistics, we would be very happy.

 Compaired to:

Brian77 replied on Tue, Jun 30 2009 1:51 PM

rated by 0 users

Is there a solution to this issue yet?  If not is there a time frame or a work around solution (other then monitoring all of the ports)?

Thanks,

Brian

DaveStraley replied on Tue, Jun 30 2009 2:07 PM

rated by 0 users

It looks like it will be fixed on the next release of Netflow sometime soon.

Hello Dave,

    I just wanted to give you a quick update - this should be fixed in the next version of Netflow.  I don't have a hard release date yet.  I'll let you know when I get more info.

Regards,

Kate

SolarWinds Support Team

Brian77 replied on Wed, Jul 1 2009 8:18 AM

rated by 0 users

Are there any work around solutions?  Possibly access to a beta? 

GZhytar replied on Thu, Jul 2 2009 6:26 AM

rated by 0 users

Hi Dave,

I'm glad to inform you that latest version of NTA 3.5 should address your issue.

Here steps you need to perform:

1. Go to NetFlow Summary view - click NetFlow Settings button in the top right corner of the view
2. Under GlobalSettings check option "Allow monitoring of flows from unmanaged interfaces" - Flow packets defined with only one unmanaged interface will no longer be discarded automatically.
3. Click Submit button
4. Under NetFlow Sources control manage Interfaces that you want to monitor
5. Click Submit button
6. Enjoy our latest and better NTA 3.5 :)

GZhytar replied on Thu, Jul 2 2009 9:47 AM

rated by 0 users

I'm also glad to inform you that NTA 3.5 is Globally Available.

Customers who have active maintenance could download it from Customer portal.

New customers can evaluate this great product at SolarWinds web-site: http://www.solarwinds.com/downloads/

Please find more information here: http://thwack.com/forums/t/17171.aspx

Thanks!

DaveStraley replied on Thu, Jul 2 2009 2:07 PM

rated by 0 users

Once again, I love the Solarwinds tech support.  The NTA 3.5 update is awesome, it not only corrected the Sflow issue with the HP switches (there is a setting to enable flows from unmonitored interfaces) but there was an update for IPFIX as well.  We have a couple of Nortel 8600's at our core Datacenter and we could not get Netflow data from them.  As soon as I did the update Orion recognized the flow and we started getting information.  

  All I can say is great work and I look forward to some good data!