Last 25 Traffic Analyzer Events

SolarWinds NTA informs you that SolarWinds NetFlow Service stopped.
"NetFlow Receiver Service [service name] Stopped."

To resolve the issue, restart the SolarWinds NetFlow Service:

1. Start the Orion Service Manager in the SolarWinds Orion > Advanced Features program folder.
2. Check the status of the SolarWinds NetFlow Service.
3. If it is stopped, select it, and then click Start.

SolarWinds NTA informs you that your SolarWinds NTA license does not match your SolarWinds NPM license, and SolarWinds NTA thus cannot monitor your flow traffic.
"License limitation doesn't fit Orion license!"

To resolve this event, make sure your SolarWinds NTA license matches your SolarWinds NPM license. Both NPM and NTA must be at the same license level. For more information, see Licensing SolarWinds.

SolarWinds NTA informs you that your license is expired.
"License status check failed: no valid license were found for [license key not in brackets]"

To resolve this event, log in to the SolarWinds customer portal, and procure an appropriate SolarWinds NTA license.

SolarWinds NTA informs you that incoming NetFlow v9 flows have a wrong or invalid template.
"NetFlow Receiver Service [xy] received an invalid v9 template with ID xx from device x.x.x.x. See knowledge base for more information."

Resolve the issue

1. Log in to the appropriate device and check the template.
2. Make sure the device exports an appropriate template in one-minute intervals. For more information, see Device configuration examples.
3. Make sure the template includes all required details. For more details, see Required Fields.
   

SolarWinds NTA informs you that the IPFIX template does not include required fields.
"NetFlow Receiver Service [xy] received an invalid IPFIX template with ID XX from device x.x.x.x. "

Resolve the issue

1. Log in to the appropriate device and check the template.
2. Make sure the device exports an appropriate template in one-minute intervals. For more information, see Device configuration examples.
3. Make sure the template includes all required details. For more details, see Required Fields.
   

This event informs you that the time difference between your servers (SolarWinds Orion database server, NTA Flow Storage database, and the SolarWinds NTA Service server) is above the critical threshold. The critical threshold is hard-coded to 300s.
"Time on NetFlow Receiver Service [xy] is: xxx. DB server time is xx. The difference is: 719 s. Which is above critical threshold. The data won't be correct. Synchronize the clocks and restart the service."

To resolve the issue, synchronize time settings on all servers (SolarWinds Orion database, SolarWinds NTA polling engine(s), and NTA Flow Storage database server).

This event informs you that NTA Flow Storage database is currently unavailable.
"Cannot connect to NTA Flow Storage database. SolarWinds NTA cannot save any flows now."

To resolve the issue, make sure that the NTA SQL Flow Storage database server is running and online.

This event informs the user that SolarWinds NTA is receiving NetFlow traffic from a node which is not managed in SolarWinds NPM.
"NetFlow Receiver Service [xy] is receiving NetFlow data stream from an unmanaged device (x.x.x.x). The NetFlow data stream from x.x.x.x will be discarded. Please use Orion Node management to manage this IP address in order to process this NetFlow data stream, or just use Manage this device."

To resolve the issue, click Manage This Device and complete the Add Node wizard to add the node in SolarWinds NPM. For more information, see Adding Devices for Monitoring in the Web Console.

This event informs you that SolarWinds NTA is receiving traffic from an interface which is not managed in SolarWinds NPM. However, the corresponding node is managed in SolarWinds NPM. Click Add this interface or Edit this interface to add the object to SolarWinds NPM for monitoring.
"NetFlow Receiver Service [xy] is receiving NetFlow data from an unmanaged interface 'interface1name To interface2name'. Click Add this interface or Edit this interface to manage interface and process its flow data."

To resolve the event, click Add This Interface or Edit This Interface, and add the interface to SolarWinds NPM for monitoring. For more information, see Adding Devices for Monitoring in the Web Console.

SolarWinds NTA informs you that it is receiving flow traffic from an interface, which is managed in SolarWinds NPM, but not monitored in SolarWinds NTA. This happens if the Enable Automatic Addition of NetFlow Sources in SolarWinds NTA Settings is disabled.
"NetFlow Receiver Service [xy] is receiving NetFlow data from unmonitored interface if name on node. Click Monitor NetFlow source or enable the "Automatic addition of NetFlow sources" option on the Netflow Settings page to process future NetFlow data from this interface."

To resolve the issue:

1. Click Monitor NetFlow Source and enable monitoring for the interface. For more details, see Add flow sources and CBQoS-enabled devices.
2. Click Automatic Addition of NetFlow Sources and make sure the Enable Automatic Addition of NetFlow Sources option is selected. For more information, see Enable flow monitoring from unmanaged interfaces.

SolarWinds NTA informs you that an unmonitored interface has been added into NetFlow sources automatically. This happens if you enabled the Enable Automatic Addition of NetFlow Sources option in the NTA Settings. For more information, see Enable the automatic addition of flow sources.
"NetFlow Receiver Service [xy] is receiving NetFlow data from an unmonitored interface. The interface if name on service is being added to NetFlow sources."

This event informs you that there is a time difference between your database and SolarWinds NTA servers, but it does not exceed the critical threshold.
"Time on NetFlow Receiver Service [xy] is: xxx. DB server time is xx. The difference is: xxx s. Which is above threshold. Fetched data could be unreliable."

To prevent corrupt data, synchronize time settings on all servers:

• SolarWinds Orion database
• SolarWinds NTA polling engine(s)
• NTA Flow Storage database server
  

This event informs you that the time difference between the database server and SolarWinds NTA server has been resolved and the server times have been synchronized.
"Time on NetFlow Receiver Service [xy] is: xx, DB server time is: xx. The difference is: 0s. Which is under warning threshold"

SolarWinds NTA informs you that the NetFlow service has been started. This event is triggered when the SolarWinds NetFlow Service starts.
"NetFlow Receiver Service [service name] started - listening on port(s) [port number(s)]."

SolarWinds NTA informs you if the port it is listening on has changed, or if a new port has been added. For more information, see NetFlow Collector Services.
"NetFlow Receiver Service [service name] setting was changed - listening on port(s) [port number(s)]."

SolarWinds NTA informs you that a new device using interface index mapping has been added for monitoring in SolarWinds NTA.

Interface index mapping is being used for node [node name].

SNMP index is a value identifying a specific interface. Flows coming from this device are using different values than SNMP interface indexes and SolarWinds NTA thus needs to establish a relation between the interface index and the values included in these flows.

SolarWinds NTA informs you that interface index mapping has been removed for a node.
Removing interface index mapping for node [node name].

For more information, see NetFlow event: interface index mapping used for a node.

SolarWinds NTA informs you that the database maintenance has been completed.
NetFlow Database Maintenance: Deleted x expired endpoints in x.xx seconds.For more information, see SolarWinds Orion database maintenance.

SolarWinds NTA informs you that the SolarWinds Orion database has been compressed.
Scheduled shrink performed. DB size before shrink xMB, DB size after shrink xMB, released space xMB. For more information, see SolarWinds Orion database maintenance.

SolarWinds NTA informs you that data aggregation settings for Top XX applications, Top XX Conversations or Top XX Endpoints has been changed.
Updating data to be used in showing Top [x] [Conversations, Applications, or Endpoints].
This event only occurs in SolarWinds NTA 4.0 using SQL for storing flows and in older SolarWinds NTA versions. For more information, see Adjusting Data Aggregation Settings.

SolarWinds NTA informs you that the NetFlow service has started or restarted and it is blocked by a firewall.
"Windows FireWall is turned on and its current exceptions do not allow the NetFlow Service to receive packets. Run the Configuration wizard for Services to remedy."

To resolve the issue, complete the Configuration wizard for Services:

1. Start the Configuration wizard in the SolarWinds Orion > Configuration and Auto-Discovery program folder.
2. Select Services and complete the wizard.

You can also add an exception to your firewall settings.

SolarWinds NTA informs you that you are running an evaluation version, which has not been licensed yet.
Your SolarWinds NetFlow Receiver Service Evaluation [receiver name] will expire in x days. Please contact SolarWinds support to purchase a licensed version. Thank you.

To resolve the issue, purchase a license and activate it. Your SolarWinds licenses can be activated directly during the installation process. However, SolarWinds also provides a powerful License Manager which allows you not only to activate your licenses, but also deactivate a license on a certain machine and re-activate it elsewhere.

SolarWinds NTA informs you that the port SolarWinds NTA is listening at is being used by another listener. SolarWinds NTA thus cannot collect flows.
Unable to start listening on port x. Waiting until the port is free.

To resolve the issue:

1. Log in to the device and check what applications use the port SolarWinds NTA is using. Port 2055 is the default.
2. If the port is being used by another application, close the application.
3. If the port is being used only by the SolarWinds NetFlow Service, restart the service:
   1. Start the Orion Service Manager in the SolarWinds Orion > Advanced Features program folder.
   2. Check the status of the SolarWinds NetFlow Service.
   3. If it is stopped, select it, and click Start.

SolarWinds NTA informs you that the port it is listening at is free again, and that the issue has been resolved.
Port x is free, listening.

SolarWinds NTA informs you that you have reset the Last 200 Events view by clicking Clear Notification.
"Resetting unknown traffic notifications events."

For more information about seeing cleared events, see Filter events and display historical events in SolarWinds NTA.

This event is triggered when the connection to NTA Flow Storage database is restored.