Logs & Diagnostics
Logs & Diagnostics
To effectively troubleshoot NFO, you must understand how its internal processes interact and where they store their event data. NFO is built on a decoupled architecture, meaning the processing engine, the management controller, and the enrichment feeder all maintain independent log files.
Where to Start?
Identify the component related to your issue to find the correct logs:
NFO Server & Controller Logs
Focus: /opt/flowintegrator
Use these logs if you have issues with:
- Flow ingestion (NetFlow/IPFIX) and processing modules.
- Data delivery to your SIEM (Splunk, Sentinel, etc.).
- Web UI access, user authentication, or license management.
EDFN Logs
Focus: /opt/nfi-updater
Use these logs if you have issues with:
- Enrichment data (Threat Lists, GeoIP, User Identity).
- Cloud Flow Log collection (AWS, Azure, GCP, OCI).
- Communication between the Feeder and the NFO Controller.
Troubleshooting Resources
Beyond raw log files, use these guides to understand system behavior and collect data for support:
Understanding NFO Processes
NFO components use a Parent/Child process model. This page explains how to verify that nfc_svr and the various jsvc workers are running correctly on Linux and Windows.
Exporting Logs & Support Bundles
Learn how to use the "Download Logs" utility in the Web UI to generate a comprehensive diagnostic package. This is a required step before opening a ticket with NetFlow Logic Support.
Quick Path Reference
| Service | Linux Log Path | Windows Log Path |
|---|---|---|
| NFO Engine | /opt/flowintegrator/logs/bak/ | C:\NetFlow\rest\logs\ |
| NFO Controller | /opt/flowintegrator/tomcat/logs/ | C:\NetFlow\tomcat\logs\ |
| EDFN Feeder | /opt/nfi-updater/logs/ | C:\NetFlow\updater\logs\ |
You can monitor the most important logs directly from the Web UI by navigating to Help > Logs. Use the Tail feature to watch events as they happen, which is often faster than accessing the CLI during a live triage session.
Next Step: Would you like me to generate the Troubleshooting Drops with NFO Logs page now to complete the "Data Quality & Performance" section?