Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

 

Correcting Flow Time Stamps

 

You can specify the way that you want flow time stamps to be handled when Netflow V9 begins sending records with overflowed system uptime values.

Two new configuration settings provide more control over the way that flow time stamps are handled when Netflow V9 begins sending records with overflowed system uptime values. The new settings eliminate the need to reset the first and last switched times.

The new configuration options and the default values are shown here:

  • NORMALISE_OVERFLOWED_UPTIMES=YES

  • UPTIME_OVERFLOW_THRESHOLD_MSEC=86400000

The time stamps are corrected when the system uptime value is less than the first and last switched packet times by more than the value that is specified in the UPTIME_OVERFLOW_THRESHOLD_MSEC configuration. The time stamps are corrected based on the assumption that the system uptime wrapped around the maximum 32-bit value.

  1. To change these settings, add the settings to the /store/configservices/staging/ globalconfig/nva.conf file.
  2. To fine-tune the settings, specify a different time interval for the UPTIME_OVERFLOW_THRESHOLD_MSEC setting.
  3. To disable this feature, set the NORMALISE_OVERFLOWED_UPTIMES to NO.

    When this feature is disabled, JSA does not modify the NetFlow v9 time stamps that meet this condition.

  4. After you change the configuration settings, you must deploy the system.

Related Documentation