Troubleshoot Drops with NFO Logs

If you see drop counts at NFO > Status, you can find more information in NFO logs. The following table contains description and general explanation for packet drops.

Drop type


dropped by input threads

Total number of packets received by NFO and dropped because they did not pass basic validation tests, e.g. packets are not one of known flow format – NetFlow v5/v9, sFlow, IPFIX, etc. Packets can also be dropped by input threads if NFO is unable to queue them for subsequent processing, e.g. out of memory, queue overflow, etc.

dropped by work threads

The number of packets dropped when flow records is processed by Modules, e.g. there is no NFv9 or IPFIX Template for the flow record, or when there are other problems when processing flows, or when processed flows could not be placed in the Output queue. A small number of these drops is expected when NFO is restarted, while Templates are not yet received.

dropped by kron thread

The number of packets dropped by “Data collection interval” triggers caused by queue overflow.

dropped at output

The number of packets dropped by NFO due to Output queue overflow.

dropped by QoS

The number of packets dropped by NFO internal Quality of Service mechanism to avoid congestions. These drops are also included in one of the drops statistics above.