Troubleshooting FlowCollector

• What environment variables are set

• Which processes are running (or not running)

• Which temporary files have been created

• How much disk space is available in the partition where FlowCollector is installed

To invoke the nfcollector status command, enter the following command line at the UNIX prompt:

$ $NFC_DIR/bin/nfcollector status
 

When invoked, the nfcollector status command displays status information about FlowCollector and the UNIX workstation on which FlowCollector is running, including the following examples:

• Environment variables:

NFC_DIR=/opt/CSCOnfc
NFC_RESOURCEFILE=$NFC_DIR/config/nf.resources
 

• Running and stopped processes:

NFCD: running (pid: 8745)
NFCollector Aggregation: stopped
NFCollector Timer: stopped

To invoke the show-tech command, enter the following command line at the UNIX prompt:

$ $NFC_DIR/bin/nfcollector show-tech
 

When invoked, the show-tech command creates a log file named show-tech.log in the directory $NFC_DIR/logs, and saves the following information in it:

• Username

• Current time

• Relevant environment variables

• System information

• System tunable parameters

• nfc_install.log and nfcd.log files (with running configuration dump)

• nf.resources and nfconfig.file

• udp_max_buf (only on Solaris installations)

• netstat results

• Disk space

• pkginfo (only on Solaris installations)

• swlist (only on HP-UX installations)

• Process listing

• Control files

$NFC_DIR/tools/fdcount [-p UDP-port][-c count][-s socket-buffer]
 

where:

-p UDP-port	UDP port number on which flows are to be received. The default is 9991.
-c count	Number of flows to sample before calculating the incoming rate. The default is 100.
-s socket-buffer	Receive socket buffer size, in bytes. The default is 90000 bytes.

$NFC_DIR/tools/fdget [-p UDP-port][-s socket-buffer][-a]
 

where:

-p UDP-port	UDP port number on which flows are to be received. The default is 9991.
-s socket-buffer	Receive socket buffer size, in bytes. The default is 90000 bytes. This argument and value determine how many datagrams the kernel stores in this buffer as datagrams come in from the network. The larger the buffer, the more time fdget has to consume data from the buffer before the buffer overflows. If the buffer overflows, datagrams are lost.
-a	Print an acknowledgment only. The default is to print the content of flows. Using -a means print only an acknowledgment for each datagram received rather than the content of the datagram.

$NFC_DIR/tools/fdplayback [-f datafile][-d IP-address][-p UDP-port][-i delay]
[-b burst] [-ssocket-buffer] [-tflows]
 

where:

-f datafile	Name of data file to play back to the user-specified destination (defined by IP address and UDP port number).
-d IP-address	Destination IP address.
-p UDP-port	Destination UDP port number. The default is 9991.
-i delay	Delay (in milliseconds) between datagrams. The default is 1000. The longer the delay, the more separation there is between datagrams being sent to the receiving destination.
-b burst	Number of flows sent in each burst. The default is 10. This argument is used in conjunction with -i to control the speed and "burstiness" of the playback.
-s socket-buffer	Receive socket buffer size, in bytes. The default is 90000 bytes.
-t flows	Number of flows to play back in this session. The default is all flows in the data file. If the data file contains 1000 datagrams and you set -t to 1, fdplayback only sends one datagram.

Recommended Action   Perform the following steps:

Step 1 Use the nfcollector status command to verify which processes are running.

Step 2 Use the nfcollector stop all command to stop FlowCollector.

Step 3 Look in the appropriate configuration file for one of the following:

• Configuration parameter that does not follow the required syntax

• Invalid configuration value

• Configuration parameter with one or more required lines preceded by comment characters

Step 4 Fix the configuration file.

Step 5 Restart FlowCollector.

Possible Cause   In some rare cases, FlowCollector might find itself in a state where the nfcollector stop all command does not stop the collector cleanly, leaving temporary files in /tmp.

Possible Cause   Either the DataSetPath thread attribute process does not have the appropriate permission settings, or the MaxUsage thread attribute value has been exceeded.

Recommended Action   Look at the nfc.log file to find the exact cause. If the problem is permission settings, fix the permission settings and try again. If the problem is related to the MaxUsage setting, increase the limit (if acceptable). You might need to make more disk space available in this partition.

Symptom   The export device is exporting NetFlow data to a port, but FlowCollector does not see any data.

Recommended Action   Verify that the export device is not using a reserved port number in its attempt to export data to FlowCollector. Use an unreserved port number in the range 1024 to 65535 (for example, 9995 or 9996) to export data to FlowCollector.

Symptom   The filesready file does not display the FORMAT identifier header.

Possible Cause   FlowCollector 3.0 is operating in FlowCollector 2.0-compatible mode.

Possible Cause   FlowCollector 3.0 is operating in FlowCollector 2.0-compatible mode.

Recommended Action   Reconfigure the HP-UX system to operate in Trusted System Mode.

Symptom   Data files that are created at a certain time appear with a totally different time stamp. For example, a data file was created at 11 p.m., but the file itself shows a creation time of 7 a.m.

Possible Cause   The system is running Solaris Version 2.7.

Recommended Action   Use a system running Solaris Version 2.51 or 2.6. Solaris Version 2.7 is not supported.

Symptom   During installation on an HP-UX system, an error is encountered and FlowCollector does not finish installing.

Recommended Action   Use a system running HP-UX version 11.0. All other HP-UX versions are not supported.