Exporter not showing up in Scrutinizer

[BenjaminM]

dchang0 Says:
December 2nd, 2011 at 8:07 am
I’m getting exactly this problem, and Wireshark and Flowalyzer both see Netflow V9 packets coming in on port 2055 (even with UDP checksum validation turned on in Wireshark).

Yet, Scrutinizer still doesn’t see anything, even though the four lights are green.

Is this because I’m running with the default license that came with the installation? I didn’t fill out any request for a license since I saw that a code is already present in each of Admin > Settings > Licenses > Cisco Advanced Reporting and Flow Analytics. If I click “Defaults” on that page, it wipes the keys out and generates an error: “The action was completed but there was a problem notifying the collector: Bad file descriptor.”

But Scrutinizer doesn’t work with or without the license codes in there.

What do I do now? (The license code fields are blank at this point.)

When I click on License Details, I noticed that the IP address for the license request is incorrect (there are two NICs in this server). Perhaps that is the problem?

Hi dchang0,

We may need more information to properly help you with this issue.

-What version of Scrutinizer are you running at the moment?
---I ask because our latest version supports up to 5 devices. All other devices will be innactive---

If the IP of the server is changed than the NetFlow may not be directed to the right destination on your devices. Multiple IP addresses only affects Scrutinizer if there is a valid license key in place. A license key is tied to the IP that is at the top of your binding order of IPs.

Thanks,
Ben

[dchang0]

Hi, Ben--

We're testing Scrutinizer 8.6.2.16204.

Yup, it looks like Scrutinizer picks the IP at the top of the binding order (as do other programs). Unfortunately, this is not the world-facing IP--it is on our backup network.

Our Netflow device is a Cisco ASA 5505 at 192.168.0.1, and it is dutifully sending Netflow V9 packets to the world-facing IP of our server at 192.168.0.7 on port 2055. Other Netflow tools, if told to listen on the 192.168.0.7 interface, can receive the Netflow...

Right now, there are no license keys at all in the Admin > Settings > Licenses fields (because I pressed the Defaults button). The result is that on the MyView > Flow Analytics Configuration panel, there is only one item called "Flow Analytics Overall Status" and it is requesting "- Please enter your Flow Analytics license -".

I put in a request for a new license key using the correct world-facing IP address of 192.168.0.7. Hopefully, when I get it, that will fix the problem.

Any tips?
D.

[BenjaminM]

Hi dchang0,

Excellent. Please let me know if that works out.

Thanks,
Ben

[dchang0]

It occurred to me that maybe Scrutinizer is still supposed to receive Netflow packets even if no license keys are present. Is that the case?

[BenjaminM]

Hi dchang0,

Yes Scrutinizer should see flows even without a license.

If you go to Admin>Definitions>Manage Exporters are there any exporters in the list? Are any of them set to inactive?

Can you verify that you are listening to port 2055? If you go to Admin>Settings>System Preferences and look at what ports you are listening to?

Can you send me either a screen shot of the wireshark capture or a packet capture of the device? Make sure to use ip.src == x.x.x.x && CFLOW as the filter.

On the Scrutinizer server, if you check the services, is the flow_collector actually running?

Thanks,
Ben

[dchang0]

Hi--

Here's the Wireshark screen capture. CFLOW packets are just flying by like crazy from 192.168.0.1 to 192.168.0.7 on port 2055.

[dchang0]

Here's the screenshot of the Manage Exporters screen. It shows that yes, we are listening on port 2055 and that no exporters have been discovered by Scrutinizer. I confirmed this also in Admin > Settings > System Preferences.

I have checked in the Windows Services control panel, and yes, the flow collector is running. I even restarted it a few times during testing as well as rebooting the entire server.

The RRD databases seem to be getting updated at least by their timestamps but don't seem to be growing in size.

[BenjaminM]

Hi dchang0,

Is something listening on port 2055 that is not supposed to (or supposed to?). Try running from command line > netstat -ab > netstat.log - This will pipe the netstat to a .log file. Search for anything that may be listening on port 2055.

Thanks,
Ben

[jghidoni]

Hi dchang0,

Do you still have Flowalyzer running on the server in Listener mode? If so, can you stop Flowalyzer, then restart the plixer_collector windows service? (You may have to kill the scrut_collector.exe process in Windows Task Manager for the plixer_collector service to stop).

Then start the plixer_collector service again and let me know if you now see the ASA in Scrutinizer.

I also sent you an email and would like to help you directly if this doesn't resolve this issue.

Joanne