Why do i get the message "The flow processor has dropped flows."?

Votes:

0

Your Vote:

Up

Down

Why do i get the message "The flow processor has dropped flows. Try optimizing your include, exclude and filter rules (Most likely matches first, use brackets to structure the rule, use ip ranges and masks instead of seperate IPs) (code: PE111)"? And what can I do to "fix it"?

jflow netflow prtg sflow xflow

Created on Sep 16, 2011 11:09:06 AM by  Torsten Lindner [Paessler Support] (15,450) 3 1

Last change on Sep 19, 2011 9:08:48 AM by  Daniel Zobel [Paessler Support] (21,383) 3 3



1 Reply

Accepted Answer

Votes:

0

Your Vote:

Up

Down

This happens if PRTG is not able to process the incoming flows fast enough. To process a flow PRTG has first to check the include and exclude filter and then all the rules used for the channels. Depending on number of flows per second, complexity of the rules and processing power of the probe system the error then might be triggered sooner or later.

Try the following to resolve the issue:

  1. Make sure no other process is degrading the system performance.
    This can be scheduled tasks (like backup or a virus scan) overloading the probe to specific times or events like a seach engine scan on your webserver.
    The system health sensor of PRTG can help here. Create a process sensor if you suspect a specific process.
  2. Check the complexity and number of rules you use
    If you are using very long filter expressions try to optimize them for faster evaluation. Put the most likely matches first, use brackets to structure the rule, use ip ranges and masks instead of seperate IPs.
  3. Check your toplists
    Toplists take a lot of processing power too and can block the core-probe communication. Delete all toplists you do not necessarily need. Toplists with less fields are preferable. Disable "live" toplists where not required.
  4. Use a remote probe on a seperate machine
    Best performance can be achieved with a physical (non virtual) system with 4 (or more) cores. Each sensor has its own flow processor using a thread so more cores help if you have a lot of (flow-)sensors.
  5. Use multiple remote probes
    Separate the load on multiple machines. If you have multiple routers send the flow streams to different probes, if you have one router you can send the same stream to two probes with half the sensors.

Created on Sep 16, 2011 11:14:45 AM by  Torsten Lindner [Paessler Support] (15,450) 3 1



Please log in or register to enter your reply.


Disclaimer: The information in the Paessler Knowledge Base comes without warranty of any kind. Use at your own risk. Before applying any instructions please exercise proper system administrator housekeeping. You must make sure that a proper backup of all your data is available.

PRTG
Network Monitor
Intuitive to Use.
Easy to manage.

150.000 administrators have chosen PRTG to monitor their network. Find out how you can reduce cost, increase QoS and ease planning, as well.

Visit
www.paessler.com

What is this?

This knowledgebase contains questions and answers about PRTG Network Monitor and network monitoring in general. You are invited to get involved by asking and answering questions!

Learn more

Top Tags


View all Tags