Sniffer Reporter Application Management data missing 1

[rmcdaniels]

I set up a Distributed Sniffer 4.0 agent and it has been building a database for a few days now. I told the agent to import all the data types every five minutes. When using Sniffer Reporter, I am getting good data for the Global Statistics, Host Table, Matrix, and Protocol Distribution, but the Application Management data only ran for one five-minute period when I started he agent. I have set up both the agent and the reporter on two different machines to no avail. What am I missing?

Thanks

 

[AlfSutherland]

Hi,
The only thing that you could possibly of missed is the "Application Responce Time" option within "Database", "Options" in the Sniffer GUI.
Are the "(date)art.csv" files being created on the agent within the cards folder within the program files (C:\program files\nai\dsproagentnt\program\"card"\"date&quot.
Might be worth rebooting the agent as well.
Alf

 

[rmcdaniels]

Hello Alf,

Thanks for the reply. I have the ART box checked in the database options and the ART CSV files are being created. The ART CSV files are pretty large, but they are smaller than the Matrix CSV files which work fine. I looked at the ART CSV file with Notepad and it looked fine. I tried rebooting the agent to no avail. I just tried removing and reinstalling the agent SW and the application management data started updating but the matrix information stopped updating. I turned off some information I don't really need (frame-relay, alerts, expert, MAC layer stuff, IPX stuff) and it seems to be working now. The agent machine meets the specs per the manual with the exception of the NIC and that it has three times the memory required. It seems to be working now, so I'll let it run for a few days and see how it goes. Is there any benefit from using the NIC specified in the manual?

 

[AlfSutherland]

Hi,
The main advantage of using NAI cards are that as NAI have written particular drivers for the cards, so they will pick up the physical errors, that normal drivers would disguard. In a switched environment though, switches wont propigate this errors, so you wont see them anyway!
For non-ethernet and higher speed topologies, NAI cards will guarentee "Full Packet Capture" ie no dropped packets. If you use a normal gigabit ethernet card, Sniffer will dislay it as a 1000Mbps ethernet, and wont show you the channel info etc etc like-wise with other topologies.
Alf