PCM+ B_02_10_5 bogus traffic

[Les Ligetfalvy]

There is still no word on this issue.

[Steve Britt]

A bug was introduced in autoupdate package #5 (AU5) that led to the symptoms you reported. There were many changes made to the traffic data collector in AU5, almost all related to improving collection scalability. Normally changes of this magnitude would not be included in an autoupdate but it was felt that the potential benefits in terms of scalability were worth the heightened risk, as the code had been under test within the development lab for about 6 weeks prior to the release of AU5.

In a nutshell, our testing failed to anticipate a particular pattern of IP addressing which anyone who has seen this bug has in their environment. When the collector receives sFlow samples from devices that meet the pattern it gets confused when computing hash keys from the incoming sFlow datagrams, and essentially multiplexes the data from multiple ports (across the devices) into the same set of internal data counters. This multiplexing leads to the erroneous values you observed in Traffic Monitor. Note that *only* sFlow data collection is affected by this bug - AU5 will correctly report statistics and sampled XRMON data.

This problem has been remedied and another autoupdate that fixes the problem, AU6, is on the way this week. We are truly sorry for any issues that this bug has caused for you. Please rest assured that we have augmented our testing procedures to ensure that nothing of this sort will occur again, and that changes proposed for inclusion in autoupdate will undergo additional scrutiny before they are accepted from this point forward.

Regards,

SVB

[Les Ligetfalvy]

Thanks Steve, for the update. Is it a known issue whereby setting for notify actually installs the update? Do you want to persue this? On the same incident number or open a new one? I just changed the frequency from once a week to once a day.

[Steve Britt]

Les,

It is not a known issue whereby setting for notify actually installs an autoupdate. We will definitely pursue it, and in fact have been trying to replicate the behavior internally since you first mentioned the issue with no success thus far. Let's just use the same incident number; I will make sure our support engineers are aware that the autoupdate facet of the incident is still open.

AU6 was posted today, and should fix the erroneous traffic numbers you were seeing with AU5.

Regards,

SVB

[Per Larsson]

I have updated to update 6 now. But now all I get i "Awaiting Connection" in Traffic Monitor. I tried to delete the devices and discover them again, but I get the same result.
Is there some configuration that I have missed?

[Steve Britt · Accepted solution]

Per,

Go to the Windows Service control panel and restart the HP ProCurve Traffic Launch Service. The message you're seeing indicates that for some reason the socket connection between the traffic data collector and PCM server processes has not been established - the PCM server is awaiting that connection. After you restart you should see that message disappear, and if you look at the Processes tab in Windows Task Manager you should see Trafficd.exe - the traffic data collector - listed.

Regards,

SVB

[Les Ligetfalvy]

OK, I dragged my heels to see what PCM was going to do with the update and all it did was notify me and make a liar out of me. It now has me doubting myself... as I move the mouse around, I see that the focus need not be right on the radio button but anywhere on the line so I wonder if I inadvertently switched between Download and Notify with the slip of the mouse.

Lets not persue this any further at this time. I will watch it closely and if does it again, re-open this case. The bogus high watemarks are gone.

Thanks

[Les Ligetfalvy]

OK, I re-opened the incident. Despite PCM being set just to notify, it downloaded and installed Update 7.

Speaking of update 7, it may be too early to tell but so far traffic is reporting more points and for a longer time. Generally my graphs look like a bad dentist worked on them and they seem to diminish what they will report on within hours of being rebooted. Eventually the top talkers reported will even include insignificant traffic like DHCP and DNS requests.

The release notes make no mention of traffic reporting changes.

[Mohieddin Kharnoub]

Hi

I wonder what kind of data collection methode you use, is it sampling or stats ?

Good Luck !!!

[Les Ligetfalvy]

I use only Sampler.

So far on day two, my graphs still show more data than toothless gaps and all Top 5 connections are plausible without miniscule any ping or DHCP or DNS stuff included.

I'm guessing something was improved but not mentioned in the release notes. Maybe I should "Disable automatic updates" entirely and stay frozen on this build which appears to be the best it has been in a very long time.

NAW! I still need the port speed change autodetect fix. What was I thinking?