No Data Found

[NetworkDude2021]

Hi, New to NNA here, and am hoping to buy this if I can get it working correctly. So this is a fresh install on a Centos7 VM. Install was easy, and setting up a source was straight forward. Netflow is being generated from a Cisco 9300 switch, specifically from a gig interface, input and output.

My issue is that the Dashboard shows the source as having "no data". As well the view in source does not show any bandwidth for this.

I did verify via TCP dump on port 9914 that traffic is coming in. As well I can actually run a custom report on top talkers for the last 2 hours and it will show data.

I would post a screenshot, however I can not figure this out.

I did see a post with No data, and the user indicated it was an issue with timezone. I did verify that time i synced via NTP on the Switch and the NNA collector, timezone being CST.

Thanks for any help you can give.

[tgriep]

If possible, can you post the configuration from the Cisco 9300 so we can check it?

There is a setting that could cause the issue you are seeing.

If the flow data does not send the Absolute Time Stamp in the flow data, it would cause what you are seeing.

We don't have access to the same equipment but under the flow record setting, make sure the timestamp settings are as follows.

Code: Select all

collect timestamp sys-uptime first
collect timestamp sys-uptime last

[NetworkDude2021]

Thanks so much for checking this out. Much appreciated.

Here is my config I have in my switch:
flow record defaultApplicationTraffic
match ipv4 protocol
match ipv4 source address
match ipv4 destination address
match transport source-port
match transport destination-port
match ipv4 tos
match flow direction
match interface input
collect transport tcp flags
collect counter packets long
collect timestamp absolute first
collect timestamp absolute last
collect interface output
!
!
flow record Interface-Out-FR
match ipv4 protocol
match ipv4 source address
match ipv4 destination address
match transport source-port
match transport destination-port
match ipv4 tos
match flow direction
match interface output
collect transport tcp flags
collect counter packets long
collect timestamp absolute first
collect timestamp absolute last
collect interface input
!
!
flow exporter Netflow-to-Nagios
destination 10.31.41.110
source Vlan41
transport udp 9914
!
!
flow monitor Netflow1
exporter Netflow-to-Nagios
cache timeout active 60
record defaultApplicationTraffic
!
!
flow monitor Netflow-INT-out
exporter Netflow-to-Nagios
cache timeout active 60
record Interface-Out-FR

interface TenGigabitEthernet2/1/1
no switchport
ip flow monitor Netflow1 input
ip flow monitor Netflow-INT-out output
ip address 10.209.4.246 255.255.255.252
ip pim sparse-mode

[tgriep]

In the "flow record defaultApplicationTraffic" record settings, add this

Code: Select all

collect counter bytes long

That is the only setting I see that is missing.

If that does not help, we will have to capture the data from the Cisco device and analyze it.

Login to the NNA server as root and install tcpdump if needed by running this.

Code: Select all

yum install tcpdump -y

Run this command for at least 30 minutes so there is enough data to decode.

Code: Select all

tcpdump -i any -s 65535 -w 9914.cap port 9914

Stop the tcpdump and upload the 9914.cap file here.
You might have to zip it up first.

[NetworkDude2021]

Ok Great thank you. My maint window is tomorrow 1/29 after 5pm Central. I will make those changes and report back.

[ssax]

Sounds good, we'll keep an eye out for your update.

[NetworkDude2021]

Alright we are in business. The addition of the "collect counters bytes long" did it. Thank you very much for your help resolving this issue!!!

My bandwidth graph has now populated along with the "no data" is now gone and we have the little bar graph showing traffic.

[scottwilkerson]

Alright we are in business. The addition of the "collect counters bytes long" did it. Thank you very much for your help resolving this issue!!!

My bandwidth graph has now populated along with the "no data" is now gone and we have the little bar graph showing traffic.

Great!

Locking thread