Dropped by input threads

Problem

What to look for / Recommendation

Unknown flow format

Debug level:

"Input thread %d: NFv5 packet %u failed sanity check: %d\n"

"Input thread %d: NFv9 packet %u failed sanity check: %d\n"

"Input thread %d: IPFIX packet %u failed sanity check: %d\n"

"Input thread %d: sFlow packet failed sanity check: %d\n"

"Input thread %d: src addr: %s P2 FDR id: %u size: %u\n"

Flood level:

"Input thread %d: UNRECOGNIZED: src addr: %s size: %u\n"

Recommended action: Check if UDP packets sent to NFO are one of the supported flow protocols: NFv5/v9, IPFIX, sFlow, FDR P2

NFO is unable to read packet from NFO input port

Debug level:

"Input thread %d: receiver failure %d\n"

Recommended action: Check health of the sockets opened by NFO for input ports

Insufficient memory when NFO reads packet from NFO input port

Error level:

"Input thread %d: failed to allocate buffer for derived objects\n"

Recommended action: Check free RAM availability on NFO host

Problem related to templates for NFv9 or IPFIX data records

Debug level:

"TFS CHECK: pkt longer than size in hdr: %u expected %u\n"

"TFS CHECK: pkt shorter than size in hdr: %u expected %u\n"

Recommended action: Check that all incoming NFv9/IPFIX packets meet specification

Problems when placing packets from input thread to work thread after validation. You may also get +1 in dropped by QoS if RED queue is full

Error level:

"Input thread %d: worker thread %d QoS queue failure %d\n"

Recommended action: Check free RAM availability on NFO host or report a bug if sufficient memory is available

Verbose level:

"Queue is full.\n"

Recommended action: Increase worker threads count (and increase the number of cores/processors if needed) or disable unused Modules.