NTA informs you that SolarWinds NetFlow Service stopped.
"NetFlow Receiver Service [service name] Stopped."

To resolve the issue, restart the SolarWinds NetFlow Service:

1. Start the SolarWinds Platform Service Manager in the SolarWinds Orion > Advanced Features program folder.
2. Check the status of the SolarWinds NetFlow Service.
3. If it is stopped, select it, and then click Start.

NTA informs you that your NTA license does not match your NPM license, and NTA thus cannot monitor your flow traffic.
"License limitation doesn't fit Orion license!"

To resolve this event, make sure your NTA license matches your NPM license. Both NPM and NTA must be at the same license level. For more information, see Licensing SolarWinds.

NTA informs you that your license is expired.
"License status check failed: no valid license were found for [license key not in brackets]"

To resolve this event, log in to the SolarWinds customer portal, and procure an appropriate NTA license.

NTA informs you that incoming NetFlow v9 flows have a wrong or invalid template.
"NetFlow Receiver Service [xy] received an invalid v9 template with ID xx from device x.x.x.x. See knowledge base for more information."

Resolve the issue

1. Log in to the appropriate device and check the template.
2. Make sure the device exports an appropriate template in one-minute intervals. For more information, see Device configuration examples.
3. Make sure the template includes all required details. For more details, see Required Fields.
   

NTA informs you that the IPFIX template does not include required fields.
"NetFlow Receiver Service [xy] received an invalid IPFIX template with ID XX from device x.x.x.x. "

Resolve the issue

1. Log in to the appropriate device and check the template.
2. Make sure the device exports an appropriate template in one-minute intervals. For more information, see Device configuration examples.
3. Make sure the template includes all required details. For more details, see Required Fields.
   

This event informs you that the time difference between your servers (SolarWinds Platform database server, NTA Flow Storage database, and the NTA Service server) is above the critical threshold. The critical threshold is hard-coded to 300s.
"Time on NetFlow Receiver Service [xy] is: xxx. DB server time is xx. The difference is: 719 s. Which is above critical threshold. The data won't be correct. Synchronize the clocks and restart the service."

To resolve the issue, synchronize time settings on all servers (SolarWinds Platform database, NTA polling engine(s), and NTA Flow Storage database server).

This event informs you that NTA Flow Storage database is currently unavailable.
"Cannot connect to NTA Flow Storage database. NTA cannot save any flows now."

Resolve the issue

Make sure that the NTA SQL Flow Storage database server is running and online. For tips on troubleshooting issues with the SQL database, see Best practices and troubleshooting for the SolarWinds Platform database in the SolarWinds Platform documentation.

This event informs the user that NTA is receiving NetFlow traffic from a node which is not managed in NPM.
"NetFlow Receiver Service [xy] is receiving NetFlow data stream from an unmanaged device (x.x.x.x). The NetFlow data stream from x.x.x.x will be discarded. Please use Orion Node management to manage this IP address in order to process this NetFlow data stream, or just use Manage this device."

Resolve the issue

Click Manage This Device and complete the Add Node wizard to add the node in NPM. For more information, see Adding Devices for Monitoring in the Web Console.

This event informs you that NTA is receiving traffic from an interface which is not managed in NPM. However, the corresponding node is managed in NPM. Click Add this interface or Edit this interface to add the object to NPM for monitoring.
"NetFlow Receiver Service [xy] is receiving NetFlow data from an unmanaged interface 'interface1name To interface2name'. Click Add this interface or Edit this interface to manage interface and process its flow data."

Resolve the issue

Click Add This Interface or Edit This Interface, and add the interface to NPM for monitoring. For more information, see Adding Devices for Monitoring in the Web Console.

NTA informs you that it is receiving flow traffic from an interface, which is managed in NPM, but not monitored in NTA. This happens if the Enable Automatic Addition of NetFlow Sources in NTA Settings is disabled.
"NetFlow Receiver Service [xy] is receiving NetFlow data from unmonitored interface if name on node. Click Monitor NetFlow source or enable the "Automatic addition of NetFlow sources" option on the Netflow Settings page to process future NetFlow data from this interface."

Resolve the issue

1. Click Monitor NetFlow Source and enable monitoring for the interface. For more details, see Add flow sources and CBQoS-enabled devices.
2. Click Automatic Addition of NetFlow Sources and make sure the Enable Automatic Addition of NetFlow Sources option is selected. For more information, see Enable flow monitoring from unmanaged interfaces.

NTA informs you that an unmonitored interface has been added into NetFlow sources automatically. This happens if you enabled the Enable Automatic Addition of NetFlow Sources option in the NTA Settings. For more information, see Enable the automatic addition of flow sources.
"NetFlow Receiver Service [xy] is receiving NetFlow data from an unmonitored interface. The interface if name on service is being added to NetFlow sources."

This event informs you that there is a time difference between your database and NTA servers, but it does not exceed the critical threshold.
"Time on NetFlow Receiver Service [xy] is: xxx. DB server time is xx. The difference is: xxx s. Which is above threshold. Fetched data could be unreliable."

To prevent corrupt data, synchronize time settings on all servers:

• SolarWinds Platform database
• NTA polling engine(s)
• NTA Flow Storage database server
  

This event informs you that the time difference between the database server and NTA server has been resolved and the server times have been synchronized.
"Time on NetFlow Receiver Service [xy] is: xx, DB server time is: xx. The difference is: 0s. Which is under warning threshold"

NTA informs you that the NetFlow service has been started. This event is triggered when the SolarWinds NetFlow Service starts.
"NetFlow Receiver Service [service name] started - listening on port(s) [port number(s)]."

NTA informs you if the port it is listening on has changed, or if a new port has been added. For more information, see NetFlow Collector Services.
"NetFlow Receiver Service [service name] setting was changed - listening on port(s) [port number(s)]."

NTA informs you that a new device using interface index mapping has been added for monitoring in NTA.

Interface index mapping is being used for node [node name].

SNMP index is a value identifying a specific interface. Flows coming from this device are using different values than SNMP interface indexes and NTA thus needs to establish a relation between the interface index and the values included in these flows.

NTA informs you that interface index mapping has been removed for a node.
Removing interface index mapping for node [node name].

For more information, see NetFlow event: interface index mapping used for a node.

NTA informs you that the database maintenance has been completed.
NetFlow Database Maintenance: Deleted x expired endpoints in x.xx seconds.For more information, see SolarWinds Platform database maintenance.

NTA informs you that the SolarWinds Platform database has been compressed.
Scheduled shrink performed. DB size before shrink xMB, DB size after shrink xMB, released space xMB. For more information, see SolarWinds Platform database maintenance.

NTA informs you that data aggregation settings for Top XX applications, Top XX Conversations or Top XX Endpoints has been changed.
Updating data to be used in showing Top [x] [Conversations, Applications, or Endpoints].
This event only occurs in NTA 4.0 using SQL for storing flows and in older NTA versions. For more information, see Adjusting Data Aggregation Settings.

NTA informs you that the NetFlow service has started or restarted and it is blocked by a firewall.
"Windows FireWall is turned on and its current exceptions do not allow the NetFlow Service to receive packets. Run the Configuration wizard for Services to remedy."

Resolve the issue

Complete the Configuration wizard for Services:

1. Start the Configuration wizard in the SolarWinds Orion > Configuration and Auto-Discovery program folder.
2. Select Services and complete the wizard.

NTA informs you that you are running an evaluation version, which has not been licensed yet.
Your SolarWinds NetFlow Receiver Service Evaluation [receiver name] will expire in x days. Please contact SolarWinds support to purchase a licensed version. Thank you.

To resolve the issue, purchase a license and activate it. Your SolarWinds licenses can be activated directly during the installation process. However, SolarWinds also provides a powerful License Manager which allows you not only to activate your licenses, but also deactivate a license on a certain machine and re-activate it elsewhere.

NTA informs you that the port NTA is listening at is being used by another listener. NTA thus cannot collect flows.
Unable to start listening on port x. Waiting until the port is free.

Resolve the issue

1. Log in to the device and check what applications use the port NTA is using. Port 2055 is the default.
2. If the port is being used by another application, close the application.
3. If the port is being used only by the SolarWinds NetFlow Service, restart the service:
   1. Start the SolarWinds Platform Service Manager in the SolarWinds Orion > Advanced Features program folder.
   2. Check the status of the SolarWinds NetFlow Service.
   3. If it is stopped, select it, and click Start.

NTA informs you that the port it is listening at is free again, and that the issue has been resolved.
Port x is free, listening.

NTA informs you that you have reset the Last 200 Events view by clicking Clear Notification.
"Resetting unknown traffic notifications events."

For more information about seeing cleared events, see Filter events and display historical events in NTA.

This event is triggered when the connection to NTA Flow Storage database is restored.