Sniffer Watch doesn't get reports

[AlexTovar]

Hi all:

I have a Sniffer watch 4.0 that gets reports from 2 DSS 4-ports LAN ( PIII, 256MB RAM, 4.1 phase 2 40 GB HD), every port is connected to active mirrored ports with huge traffic.
The problem is that Sniffer watch reports don´t show traffic at ramdom schedules, for example, traffic on segment 1 was zero ( chart is blank ), but it is impossible due segments are critical and traffic is ALWAYS present ( it's a BIG bank network ).

Ports at every sniffer are Fast ethernet, and it is supposed sniffer can monitor and capture with four ports simultaneously ( 8MB buffers ), Options under Database menu were set to every 5 minutes and keep data for 60 days.

DSS' Transport ports and Sniffer Watch are attached to a dedicated switch, so traffic can't impact on communication between DSS and Watch.

Could be possible CPUs can't process all data and send information to Sniffer Watch with that heavy duty ?

In practice, can Sniffer work with full monitoring, full capture and Database options enabled simultaneously ?

We have two 4-port LAN DSSs reporting to Watch by the moment, and we are going to connect two more DSS with 4 E1 ports each ( 8 E1 ports ! ), and customer need full reporting ! I hope this is not an issue of Sniffer watch.

Any comment could help.

Alex.

 

[AlfSutherland]

Hi Alex,
Firstly the current version of Sniffer WATCH is v4.1, which I believe also has a service pack.

The new version of Sniffer Watch is now able to collect and report on Sniffer Distributed Agent data logged at 1, 5, 15, 30, and 60 minute intervals. This is an improvement on the single 60 minute granularity offered in DSS/RMON Watch 4.0. Quote "This provides the user the ability to see spikes in data that would be 'hidden' by coarser granularity and to drill down to data with finer time accuracy".

Sniffer Watch v4.1 is now able to upload data from Sniffer Distributed Agents on a 15 or 60 minute upload schedule. This is an improvement on the single 60 minute upload period in DSS/RMON Watch 4.0.

The way Sniffer Watch works is that it collects the data written to the agent's AI folder. To verify whether the agent is correctly creating this information for WATCH. In a browser type the following;
http:/Agent IP ADDRESS:8088/AI. (Assuming 8088 is the port you are using). If there is no data in here, the problem lies with the agent. It is then worth checking in the nidataconfig.ini file on the agent, make sure that
"DataSourcesCollectionEnabled3=TRUE", if not edit it to be. Reboot agent. If not make sure that the "HTTP" option is selected in the Option tab in ProbeViewer, (SniffView, selct agent, Configure, option tab).

Also make sure that the Time Zones of the agents and WATCH units are the same, pref US Pacific Time. (This causes major headaches in the UK!!!). I recommend Time syncing the units too.

There is more WATCH info available on NAI's knowledge base.

With reference to the agents;
ET05 units - it is not recomended to run captures on all of the cards at the same time, due to System resources. Sniffer only supports capture of 1.

Please look at the manual (Appendix 1 of Install and op guide) at how many interfaces are supported for various uploading periods with differing values of table sizes, for the WATCH unit to work correctly.There are limitations!!

I hope all this makes sense.
Alf Sutherland