Dropped by input threads
Problem
What to look for / Recommendation
Unknown flow format
Debug level:
"Input thread %d: NFv5 packet %u failed sanity check: %d\n"
"Input thread %d: NFv9 packet %u failed sanity check: %d\n"
"Input thread %d: IPFIX packet %u failed sanity check: %d\n"
"Input thread %d: sFlow packet failed sanity check: %d\n"
"Input thread %d: src addr: %s P2 FDR id: %u size: %u\n"
Flood level:
"Input thread %d: UNRECOGNIZED: src addr: %s size: %u\n"
Recommended action: Check if UDP packets sent to NFO are one of the supported flow protocols: NFv5/v9, IPFIX, sFlow, FDR P2
NFO is unable to read packet from NFO input port
Debug level:
"Input thread %d: receiver failure %d\n"
Recommended action: Check health of the sockets opened by NFO for input ports
Insufficient memory when NFO reads packet from NFO input port
Error level:
"Input thread %d: failed to allocate buffer for derived objects\n"
Recommended action: Check free RAM availability on NFO host
Problem related to templates for NFv9 or IPFIX data records
Debug level:
"TFS CHECK: pkt longer than size in hdr: %u expected %u\n"
"TFS CHECK: pkt shorter than size in hdr: %u expected %u\n"
Recommended action: Check that all incoming NFv9/IPFIX packets meet specification
Problems when placing packets from input thread to work thread after validation. You may also get +1 in dropped by QoS if RED queue is full
Error level:
"Input thread %d: worker thread %d QoS queue failure %d\n"
Recommended action: Check free RAM availability on NFO host or report a bug if sufficient memory is available
Verbose level:
"Queue is full.\n"
Recommended action: Increase worker threads count (and increase the number of cores/processors if needed) or disable unused Modules.
Copy link