We installed NTA 3 SP3 to demo how Solarwinds can work with Foundry equipment and cannot get any information from our sFlow devices. I have added the collector to the Foundry device and set all the other parameters that the documentation asked for. I added the device in NTA and can see all the ports but everything still says Never for Last Data Recieved. Ironview is getting the data with no problems. Is there another step that I might be missing?
Are you getting any error messages in the Traffic Analysis Evevts Resource?
No. I show where it thanks me for installing it and where the collector comes up.
The first thing you want to do is verify that Orion sees the SFLOW traffic. First, verify that you configured the flow to export on the same port that Orion is listening and that the 'SolarWinds NetFlow Service' windows service is in a started status. By default, the port that Orion NetFlow module is listening on is 2055. If you have confirmed this, you can verify that the SFLOW traffic is being recognized at the Orion server by looking at a set of performance counters that are added to the perfmon console when you install Orion Netflow module (this will be opened from the Orion server). To open this, click on Start > Run and type 'perfmon'. Click OK and you will be presented with the Performance interface. click on the 'Delete Key' icon 3 times at the top of the window to remove all counters added to the interface by default. Next, right click in the grey area of the chart and click 'Add Counters'. Under 'Performance Object', select SolarWinds and then change the radio button to select 'All counters'. Click the Add button and then the Close button. Now, at the top of the Performance window, click on the 'View Report' icon. You will see the counters for SFLOW. If you watch these, do you see the counters incrementing? If you do not, then most likely the SFLOW traffic is not making it to the Orion server and we need to look at why that would not be happening: possibly something blocking the traffic or evaluate the configuration for SFLOW export again to verify it is complete and correct.
I am getting nothing in the perfmon tool. I have checked the device and everything is setup correctly. I even changed the port in NTA to 6343 to collect on the native port. I see the bytes increasing but not sFlow data.
I added another device and configured it but to no avail. Everything works fine with collecting sFlow data in Ironview, just not this tool.
Do you have IronView and Orion Netflow configured to listen on separate ports? If you completely disable IronView, does it allow you to see the SFLOW counters incrementing. If you don't see activity on the SFLOW counters, it means that Orion doesn't see the data making it to the Orion server or it is not processing it because something about the data does not match what it is listening for.
I have the same exact problem with a Foundry switch that I am trying to view sFlow data on. I've installed PacketTrap and Adventnet Netflow on the same server and they work just fine. The Solarwinds Netflow module won't recognize the sflow data from the Foundry (FastIron Edge Switch).
Any ideas?
Check with your Foundry rep. I don't think that any of the Foundry devices support v5 of sFlow until later this year, early next year. I think that was the problem in our case. Since the Netflow module won't collect anything other than that version, we cannot do anything with it.
I've got this on the roadmap to fix.
That is good to hear. I think that this is the ONLY module from Solarwinds that we don't/cannot use.
In development, we just tested NTA with a Foundry device and were able to see the traffic from it. Can you open a ticket with Tech Support, so that we can get a sniffer trace from you? Make sure to take the sniffer trace on the machine with the NTA collector. If we have that, then we figure out what the problem is.
Thanks,
We are doing a trial and don't have access to support. Here is the packet capture. You can see the sFlow packets hitting the server on port 2055.
Ahh... no problem. Since you've attached the sniffer trace, I can have my team take a look at this and we'll get back to you. Things are a bit busy in development right now, so it may be a while.
The sniffer trace indicated that the sFlow packets are using sFlow v2. It there a switch or firmware upgrade to have it start sending sFlow v5? NTA only supports sFlow v5.
I do not believe so.
I checked with Foundry (we are a reseller) and they won't support sFlow V5 in the stackables except for the FESX series (sometime in 2009). So it looks like without v2 support, sFlow with Foundry is out of the picture unless support for V2 is introduced...