Oneview/Purview application response times missing

  • 8 February 2015
  • 32 replies
  • 1002 views

Userlevel 3
Hi,

i see no network or applications response times in Purview/Oneview, what to check in my configuration?

32 replies

I also deployed purview in HK customer site. Just see the application flows, but none matched with application group. I already enforcers application on configuration tab from netsight.
Userlevel 3
I think if you see just the flows - that just means it sees netflow data. For application detection you need to give the appliance some more data from a coreflow2 device via port mirror or policy mirror.
In my case (just a quick test with standard nms-adv license) i use policy mirror + gre tunnel, works fine - just missing the response times.
Can you post your configuration of coreflow2 device and purview? I already enabled Netflow, policy mirror and port mirror, but didn't use GRE tunnel.
Userlevel 6
Can you post your configuration of coreflow2 device and purview? I already enabled Netflow, policy mirror and port mirror, but didn't use GRE tunnel.KeN, Here's a configuration for an SSA switch that connects to the Purview engine configured in Deployment Mode 2 2. Dual Interface Mirrored Separate interfaces are configured for management and monitoring traffic. The monitoring interface will be put into tap mode for traffic monitoring.[/code] The switch sends NetFlow information through port ge.1.2 and packet information through port ge.1.17. No GRE tunnels configured here so ge.1.17 must be directly connected to eth2 port in the Purview appliance.

Here's a diagram. Sorry, the legends are in spanish...


The commands to configure this are:
set vlan create 100,1111-1112 clear vlan egress 1 lag.0.1-62;tbp.0.1-62;ge.1.1-48;tg.1.1-4 set vlan egress 100 ge.1.1-16 untagged
set vlan egress 1111 ge.1.17 untagged set vlan egress 1112 ge.1.48 untagged set ip interface vlan.0.100 default set ip address 192.168.100.1 mask 255.255.255.0 interface vlan.0.100 set port vlan ge.1.1-16 100 modify-egress set port vlan ge.1.17 1111 modify-egress set port vlan ge.1.48 1112 modify-egress set prompt PoC-SSA set cdp status disable set ciscodp status disable set gvrp disable set lacp disable set mirror create 1 set mirror 1 mirrorN 15 set mirror ports ge.1.17 1 set netflow export-interval 1 set netflow export-destination 192.168.100.20 2055 set netflow export-version 9 set netflow export-rate 20000 1 set netflow export-data enable mac set netflow export-data enable vlan set netflow port ge.1.48 enable rx set netflow template refresh-rate 30 timeout 1 set netflow cache enable
set policy profile 1 name Purview pvid-status enable pvid 0 mirror-destination 1 set policy rule admin-profile port ge.1.48 mask 16 port-string ge.1.48 admin-pid 1 set spantree portadmin ge.1.1-17,48 disable
set ssh enabled set telnet disable inbound set telnet disable outbound[/code]
Userlevel 6
Can you post your configuration of coreflow2 device and purview? I already enabled Netflow, policy mirror and port mirror, but didn't use GRE tunnel.Forgot to mention that this config assumes mirrored traffic to be analyzed is fed into the SSA through port ge.1.48.
Userlevel 3
Can you post your configuration of coreflow2 device and purview? I already enabled Netflow, policy mirror and port mirror, but didn't use GRE tunnel.i setup a purview appliance with 1 interface in VMWare, using GRE Tunnel for mirrored traffic. If you use policy manager, configure a rule/mirror there.

# tg.2.24 is an unused dummy port
set mirror create 1
set mirror 1 mirrorN 15
set mirror ports tg.2.24 1

# tg.2.15 is the port with the traffic that should be mirrored
set policy profile 9 name PurviewMirror pvid-status enable pvid 4095 mirror-destination 1
set policy rule admin-profile port tg.2.15 mask 16 port-string tg.2.15 admin-pid 9

# GRE Tunnel
# 10.10.10.1 - routable address
# gre tunnel set on the "dummy" port tg.2.24
# x.x.x.x your purview appliance
interface loop.0.1
ip address 10.10.10.1 255.255.255.255 primary
no shutdown
exit
interface tun.0.1
tunnel destination x.x.x.x
tunnel mode gre l2 tg.2.24
tunnel mirror enable
tunnel source 10.10.10.1
no shutdown
exit

then configure the gre endpoint at the purview appliance (specify source 10.10.10.1)

This example is almost from "purview deployment guide". There you can find various implementation options.
Can you post your configuration of coreflow2 device and purview? I already enabled Netflow, policy mirror and port mirror, but didn't use GRE tunnel.Thanks, all. I can see traffic flows with application groups and respone times shown.
Userlevel 6
Can you post your configuration of coreflow2 device and purview? I already enabled Netflow, policy mirror and port mirror, but didn't use GRE tunnel.Good!
Userlevel 3
Can you post your configuration of coreflow2 device and purview? I already enabled Netflow, policy mirror and port mirror, but didn't use GRE tunnel.for my case...i still dont see any response times. I doubt its all at 0ms.
Userlevel 3
Can you post your configuration of coreflow2 device and purview? I already enabled Netflow, policy mirror and port mirror, but didn't use GRE tunnel.any idea why I see no network or application response times? All other data is fine...
Userlevel 3
Hi,

I just checked the onboard netflow collector of netsight. I dont see any response times for these flows neither. Maybe a general problem with my netsight installation?
Should response times get collected for any flow? I double checked documentation and dont see any advise that I have to enable something to get these data...
Userlevel 6
Hi,

I just checked the onboard netflow collector of netsight. I dont see any response times for these flows neither. Maybe a general problem with my netsight installation?
Should response times get collected for any flow? I double checked documentation and dont see any advise that I have to enable something to get these data...
Is the tunneled data making it to the appliance? Run
tcpdump -i eth0 ip proto 47[/code]in the VM to confirm the GRE tunnel is working.
Userlevel 3
Hi,

I just checked the onboard netflow collector of netsight. I dont see any response times for these flows neither. Maybe a general problem with my netsight installation?
Should response times get collected for any flow? I double checked documentation and dont see any advise that I have to enable something to get these data...
yes, the gre tunnel is working, and data is collected - just the response times are missing
Userlevel 2
Do you have a Virtual or Hardware Purview Appliance?
Userlevel 2
In VM Ware it´s necessary to configure the Port Group for mirroring specially. The Promiscuous Mode had to be "Accepted" and the VLAN Type had to be "VLAN-Trunking" In the VLAN Area you have to be defined the VLAN "0-4094". So you can mirror tagged and untagged traffic and you will see Network and application Response Time. In our Installation with a virtual purview appliance the missing VLAN type and vlan Definition 0-4094 resolved the Problem.
Userlevel 3
Hi,
its a virtual appliance, the vmware specific configuration options are in place but we didnt set for vlan 0-4096. I'll try this...
Userlevel 2
Okay, in our case it just take some minutes. Then we saw application and Network Response time.
I also experienced the same issue. After changing the VM port group VLAN ID from 0(default) to 4095, I could see the network and application response time.
Userlevel 3
I also experienced the same issue. After changing the VM port group VLAN ID from 0(default) to 4095, I could see the network and application response time.

what purview deployment mode you run? i use "single interface" for management + the gre tunnel for mirroring. If i change the vlan id management will be affected
I also experienced the same issue. After changing the VM port group VLAN ID from 0(default) to 4095, I could see the network and application response time.

The purview deployment mode was in overlay mode with a purview engine(virtual appliance) of 2 interfaces, i.e. eth0 for management, eth1 for monitoring mirrored netflow traffic from a purview sensor(CoreFlow2 switch). I changed the VM port group(eth1) VLAN ID from 0 to 4095.
Userlevel 3
I also experienced the same issue. After changing the VM port group VLAN ID from 0(default) to 4095, I could see the network and application response time.

ok thanks for sharing, I guess the vlan issue shouldnt apply in my case because the mirrored data leaves the gre tunnel within the VM. Or maybe I need to check vlan id handling within the data leaving the gre tunnel.
Userlevel 3
On the purview appliance there is a script for testing if the necessary data is collected. I think it its appstatus or something similar. It checks if netflow and TopN Data is collected.

Regards
Michael
Userlevel 3
On the purview appliance there is a script for testing if the necessary data is collected. I think it its appstatus or something similar. It checks if netflow and TopN Data is collected.

Regards
Michael
ah nice script :-)

My setup looks ok:
--------------------------------------------------
Process appid is running at pid 1662
Process appidserver is running at pid 1027
--------------------------------------------------
Checking for traffic on interface gre1
Checking for Netflow records on interface eth0..
Checking for IPFIX records on loopback interface..
--------------------------------------------------
Waiting for captures to complete..
Mirror appears to be setup correctly on gre1.
IPFIX appears to be setup correctly.
Netflow appears to be setup correctly on eth0.
--------------------------------------------------
Userlevel 5
I have run into this issue a few times, all of the times it has to do with the mirror. The fix that I have seen is in a Virtual environment to make sure that promiscuous mode is selected on the vswitch, otherwise you will NOT get the identification nor response times. Also confirm the time is synced to NTP on the virtual appliance and switch is correct as well.
Userlevel 3
I tried the promiscuous mode settings in vMWare (vSwitch and Portgroup) with no effect. But the GRE Traffic itself is just directed unicast traffic, how could the vSwitch settings apply to this?
Checked the time - its synced.

Reply