Collector Issue with version 11.5

Scrutinizer is an enterprise/business class NetFlow and sFlow analysis tool. Scrutinizer provides historical trends of the company's critical network interfaces as well as the details on:

Who: The end system causing the traffic
What: The application/protocol that is being used
When: The time frame it has been occurring for
Where: The network connection that is affected

Moderators: scottr, Moderator Team

Post Reply
NigelT
Posts: 9
Joined: Wed Aug 14, 2013 11:23 pm
Location: Muscat, Oman
Contact:

Collector Issue with version 11.5

Post by NigelT » Thu Feb 06, 2014 1:05 am

We have recently migrated to version 11.5.1 of Scrutinizer and at the same time migrated to Windows 2012 R2. We did a fresh install of version 11.5.0 and then updated to version 11.5.1.

A few times we have experienced all flows stopping and have had to restart the plixer_flow_collector service to start collecting again.

The log from one such event is below:

2014-02-06 07:04:52 pid(1572) ProcMonitor.pm:903 - INFO - [undef] Plixer Flow Collector Restarted
2014-02-06 07:04:52 pid(1572) ProcMonitor.pm:1171 - ERROR - [undef] spawned Plixer::Scrutinizer::notifier pid 1724 - have 1 (need 1)
2014-02-06 07:04:52 pid(1572) ProcMonitor.pm:1171 - ERROR - [undef] spawned Plixer::Scrutinizer::poller pid 1388 - have 1 (need 1)
2014-02-06 08:47:53 pid(1572) ProcMonitor.pm:1308 - INFO - [undef] Plixer Flow Collector Stopped
2014-02-06 08:47:54 pid(4600) ProcMonitor.pm:361 - INFO - [undef] Plixer Flow Collector Started
2014-02-06 08:47:55 pid(2480) Helpers.pm:1114 - INFO - [undef] New license applied
2014-02-06 08:47:55 pid(3636) Helpers.pm:1114 - INFO - [undef] New license applied

Note that the first entry at 07:04 is when flow stopped being collected and the entry at 08:47:53 is when we restarted the service (stopped and started).

We would appreciate any help on resolving this issue.

Regard
Nigel Thomas

JakeB
Posts: 83
Joined: Thu Jan 10, 2013 2:15 pm

Re: Collector Issue with version 11.5

Post by JakeB » Fri Feb 07, 2014 7:48 am

Hello Nigel -

Could you provide me with the following:

Server CPU
RAM
Disks (RAID/Speeds)
Flowrate at the time of the "Crash"

You can get the flow rate by navigating to the "Vitals" dashboard and selecting the "Flows/s By Exporter " Graph and navigating to the time at which the collector stopped processing data.

Thank you,
Jake

NigelT
Posts: 9
Joined: Wed Aug 14, 2013 11:23 pm
Location: Muscat, Oman
Contact:

Re: Collector Issue with version 11.5

Post by NigelT » Mon Feb 10, 2014 12:46 am

Hello Jake,

The Scrutinizer server is a virtual server hosted on VMware. It has 16GB RAM and 8 Virtial CPUs. The disks are on an enterprise SAN.

At the time of the crash the flowrate was 525/s.

Regards
Nigel

NigelT
Posts: 9
Joined: Wed Aug 14, 2013 11:23 pm
Location: Muscat, Oman
Contact:

Re: Collector Issue with version 11.5

Post by NigelT » Mon Feb 10, 2014 1:10 am

Hello Jake,

We have just had the same problem again. It seems that this issue happens either after a new IP group is added or after an IP Group is used in a filter.

Also, when the probem happens (that is all flows stop being collected) a Windows application event is created as below:

Faulting application name: myview.cgi, version: 0.0.0.0, time stamp: 0x4c592cb9
Faulting module name: perl512.dll, version: 5.12.3.1204, time stamp: 0x4d531bcd
Exception code: 0xc0000005
Fault offset: 0x000a0974
Faulting process id: 0x11cc
Faulting application start time: 0x01cf2621a17e278d
Faulting application path: C:\Program Files (x86)\Scrutinizer\cgi-bin\myview.cgi
Faulting module path: C:\Program Files (x86)\Scrutinizer\cgi-bin\perl512.dll
Report Id: dfe9711b-9214-11e3-80c1-005056b8671a
Faulting package full name:
Faulting package-relative application ID:

I hope this helps.

Regards
Nigel

JakeB
Posts: 83
Joined: Thu Jan 10, 2013 2:15 pm

Re: Collector Issue with version 11.5

Post by JakeB » Tue Feb 11, 2014 11:09 am

Hello -

I am unable to replicate this issue here - I see you have an active maintenance contract so I will send you an email so that we can resolve this issue quicker.

-Jake

Post Reply

Who is online

Users browsing this forum: No registered users and 4 guests