No data with Cisco 4331 and Netflow Exporter

[ebounous]

No data with Cisco 4331 and Netflow Exporter

I have the exact same setup on another router... but I ungraded the server to the latest NA ver. and this router stopped working. I deleted, added (with a different name) the device, but I am getting no data. The flow info is getting sent.

Ideas??

[Box293]

Do any of these KB articles help:

https://support.nagios.com/kb/article.php?id=32

https://support.nagios.com/kb/article.php?id=31

https://support.nagios.com/kb/article.php?id=322

[ebounous]

Those are all great resources. I have gone through them initially and they all appear to be correct. I'll look at them in more detail and let you know.

Thanks

[bwallace]

Definitely let us know what you find out, we'll leave this thread open in the meantime.

[ebounous]

I found that the Firewall was turned on, I stopped it and now one of my two sources is working that was not working. I performed a NA updated and rebooted the server and now I have completely disabled the FW. The one source still not functioning, while receiving data and the flows folder looks correct, I still see 'do data' on the source. I have seen some sequence errors in the /var/log/messages, so I am thinking that somehow NA is unable to pull the data in completely, if it is out of sequence? Both 4331 routers have the exact same version and config, except a different port.

Any thoughts?

[tgriep]

Can you post the errors you are seeing in the /var/log/messages file so we can view them?
Also, check this log to see if there are any errors.

Code: Select all

/usr/local/nagiosna/var/backend.log

Can you login to the NNA server as root and run the tcpdump command to see if the server is receiving data?

Code: Select all

tcpdump port xxxx

Replace xxxx with the port that it should receive data on.

You may have to install tcpdump and that can be done by running

Code: Select all

yum install -y tcpdump

[ebounous]

I have resolved the issues with the 4331 and Netflow. After running TCPDUMP and knowing it was receiving data, I started some other troubleshooting steps....

First, changing the UDP port helped. I started all my routers with UDP ports starting in the dynamic range of 49152. The port I was using must have conflicted somehow. It wasn't' receiving all the data.

Second, I had to with one router make sure all options existed.
collect timestamp sys-uptime first
collect timestamp sys-uptime last
This must be included in the FlowRecord section of the Cisco Config. ( one router was missing this and nfdump which reads the netflow data was giving me a time error)

I now have multiple locations sending netflow data and it's working beautifully.

Thanks,
Evan

[mcapra]

Is it alright if we lock this thread and mark the issue as resolved?