cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Missing Server IP in Network Top N Report

matthew_eisengr
Inactive

Hi,

I've got Netflow only data flowing in (no SPAN or TAPs) and we are consistently seeing a '-' for the top contributing server. Any ideas as to why it would display this way?

9 REPLIES 9

matthew_eisengr
Inactive

Isn't that what the 'other' category is for?

So anything not in the top x will appear in the 'other' bucket.

In my example, it is just a '-'.

You are right! Sorry about that - I didn't see Other in your legend (although now I see it at the bottom 🙂 )

john_leight
Dynatrace Pro
Dynatrace Pro

It might be worth changing the chart back to a table. You could add more server dimensions to try and break the "-" down or see what is causing it.

anton_laurila
Advisor

Hi @Matthew,

I believe this is caused by the aggregation of the servers where individual server IPs are not reported. As John mentioned in his comment, visualizing this same data in a table will show you "Server from" and then a subnet or a site if there are any matching. From this view it is then possible to drill down into the individual servers with some limitations, such as only 2 hours of data being visible at a time and potentially much slower report loading speeds.

You'll probably have to add the "Server Aggregated Name" dimension to the report to see it. I was able to see the same thing in the "top server by bytes" section in the "Top N Network - General - Bandwidth" report. It shows a "-" for the server with the most bytes transferred. Changing it to a table and adding the "server aggregated name" shows where the server is coming from - if not the IP of the server itself.

Hi Matt

Server IPs function a little differently from client IPs. It is possible to have a - where the server IP is. Given that you only have netflow data the server aggregation should not apply. Check in the advanced properties editor. I suspect someone has set the properties PCS_TCP_PORT_TO_REJECT and PCS_UDP_PORT_TO_REJECT

This will cause those to be aggregated.

Regards

Alasdair

Al,

I checked this setting per your suggestion. It doesn't look like anything is set from what I can tell.

matthew_eisengr
Inactive

John,

I changed it to the table and got the following.

Then added dimensions: 'server aggregated name' and 'server name'. It is showing aggregation there.

Not sure how this is happening though when there is no aggregation on the system, it is in FE mode... or am I looking in the wrong place?

So the "-" in the chart is due to server aggregation.

You are showing User Options - afaik these settings do not apply to server aggregation. I am not aware of where to look for server aggregation settings.

You can link your report to a report that shows the unaggregated servers - create a link that goes to the servers dmi report. You'll need to change the apply filters to go to the correct data source. Take a look at the servers report itself (there is a recursive link) - the first link shows what you would need to pass to see the individual servers.

Perhaps someone else knows how to control the server aggregation process, or which servers get aggregated.