Custom Query populates chord chart but not the data field

[evtbmean]

Hi,

I am running what I believe is a relativly light query, and the chord chart is populating with data, but the data field beneath is not populating.

I am simply querying for traffic not destined for my internal network or my public IP addresses. I've tried very small windows like 30 minutes or 2 hours, and up to 24 hours, with no success.

Screenshot 2025-09-23 101726.png

This is a fresh install with plenty of resources (8cpu, 32GB of RAM, 256GB disk). Ubuntu 22.04.5 LTS. All other functionality appears to work as intended, including the other built-in queries like Botnets and P2P Traffic.

[ekapsner]

Hello @evtbmean,

This kind of behavior is typical of when a query tries to use more memory than PHP has been allocated. Although the query is simple, it will return most of the flow data from this source. This behavior can be avoided by increasing PHP's memory allocation or using a more specific query that will return a smaller portion of the data.

To increase the memory allocated to PHP, open /etc/php.ini in your preferred text editor. Find the line that says something like memory_limit = 128M.

This can be increased to something like memory_limit = 1024M or memory_limit = 2G.

Here is the documentation on the memory_limit variable.

Please let me know if you have any other questions.

- Emmett

[drewbinsky]

Hi,

I am running what I believe is a relativly light query, and the chord chart is populating with data, but the data field beneath is not populating.

I am simply querying for traffic not destined for my internal network or my public IP addresses. I've tried very small windows like 30 minutes or 2 hours, and up to 24 hours, with no success. Golf Hit

Screenshot 2025-09-23 101726.png

This is a fresh install with plenty of resources (8cpu, 32GB of RAM, 256GB disk). Ubuntu 22.04.5 LTS. All other functionality appears to work as intended, including the other built-in queries like Botnets and P2P Traffic.

I’m running into a similar issue. The chord chart displays data correctly, but the data table beneath it stays empty.

Details of my setup:

Fresh install on Ubuntu 22.04.5 LTS
Resources: 8 CPU, 32GB RAM, 256GB disk
Query: traffic not destined for internal networks or public IPs
Tested with multiple time windows (30m, 2h, 24h) → same result
Other built-in queries (Botnets, P2P Traffic, etc.) work fine

[ekapsner]

Hello @drewbinsky,

As articulated above, this problem stems from the query trying to use more memory than allocated. Although the query is simple, it will likely return a large portion of the flow data and use too much memory. NNA uses PHP's default memory allocation of 128 megabytes. To remedy this, one can either use a more specific query or increase the memory allocated to PHP.

- Emmett

[evtbmean]

This issue was in fact the memory limitation. I changed that and now my data renders as expected.

I also want to indicate that I went to the Mysql configs and also increased the innodb buffer pool. The combination of those feels like the overall interface is much more snappy and responsive.

[ekapsner]

Thanks for the update, @evtbmean. I'm glad increasing the memory allocation fixed the issue and thanks for the tip about the InnoDB buffer pool. I'll be sure to recommend that as well going forward.

[freddy2]

Sorry for interfere, but would increasing the PHP memory limit alone be enough, or should I also tweak MySQL settings for better query performance?

[ekapsner]

Hi @freddy2,

From my testing, increasing the PHP memory limit should be enough. Increasing the InnoDB buffer pool, assuming the resources for it are present, is optional but will likely improve performance. Please let me know if you have any further questions.

- Emmett