{"action":"created","issue":{"url":"https://api.github.com/repos/robcowart/elastiflow/issues/141","repository_url":"https://api.github.com/repos/robcowart/elastiflow","labels_url":"https://api.github.com/repos/robcowart/elastiflow/issues/141/labels{/name}","comments_url":"https://api.github.com/repos/robcowart/elastiflow/issues/141/comments","events_url":"https://api.github.com/repos/robcowart/elastiflow/issues/141/events","html_url":"https://github.com/robcowart/elastiflow/issues/141","id":343206382,"node_id":"MDU6SXNzdWUzNDMyMDYzODI=","number":141,"title":"sFlow unknown record message","user":{"login":"papatango71","id":29801388,"node_id":"MDQ6VXNlcjI5ODAxMzg4","avatar_url":"https://avatars1.githubusercontent.com/u/29801388?v=4","gravatar_id":"","url":"https://api.github.com/users/papatango71","html_url":"https://github.com/papatango71","followers_url":"https://api.github.com/users/papatango71/followers","following_url":"https://api.github.com/users/papatango71/following{/other_user}","gists_url":"https://api.github.com/users/papatango71/gists{/gist_id}","starred_url":"https://api.github.com/users/papatango71/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/papatango71/subscriptions","organizations_url":"https://api.github.com/users/papatango71/orgs","repos_url":"https://api.github.com/users/papatango71/repos","events_url":"https://api.github.com/users/papatango71/events{/privacy}","received_events_url":"https://api.github.com/users/papatango71/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2018-07-20T18:31:11Z","updated_at":"2018-07-21T09:34:47Z","closed_at":null,"author_association":"NONE","body":"\r\n[sflow.pcap.gz](https://github.com/robcowart/elastiflow/files/2215366/sflow.pcap.gz)\r\n\r\nWe have just set up ElastiFlow and pointed one of our Juniper QFX devices at it for testing.  We are seeing the following messages in the logstash log.\r\n\r\n[2018-07-20T18:17:37,881][WARN ][logstash.codecs.sflow    ] Unknown record entreprise 0, format 7\r\n[2018-07-20T18:17:55,189][WARN ][logstash.codecs.sflow    ] Unknown record entreprise 0, format 7\r\n[2018-07-20T18:18:15,897][WARN ][logstash.codecs.sflow    ] Unknown record entreprise 0, format 7\r\n[2018-07-20T18:18:36,976][WARN ][logstash.codecs.sflow    ] Unknown record entreprise 0, format 7\r\n[2018-07-20T18:19:17,665][WARN ][logstash.codecs.sflow    ] Unknown record entreprise 0, format 7\r\n[2018-07-20T18:19:55,887][WARN ][logstash.codecs.sflow    ] Unknown record entreprise 0, format 7\r\n[2018-07-20T18:20:16,835][WARN ][logstash.codecs.sflow    ] Unknown record entreprise 0, format 7\r\n[2018-07-20T18:20:37,977][WARN ][logstash.codecs.sflow    ] Unknown record entreprise 0, format 7\r\n\r\nI have attached a pcap file for review but I don't see anything in there that is really an issue.  Any help to troubleshoot and resolve this issue would be greatly appreciated. \r\n\r\nWe currently are using Arbor and DeepField and the data that we see in those 2 apps is very similar but the graphs we are seeing in ElastiFlow are showing less bandwidth usage.  \r\n"},"comment":{"url":"https://api.github.com/repos/robcowart/elastiflow/issues/comments/406783888","html_url":"https://github.com/robcowart/elastiflow/issues/141#issuecomment-406783888","issue_url":"https://api.github.com/repos/robcowart/elastiflow/issues/141","id":406783888,"node_id":"MDEyOklzc3VlQ29tbWVudDQwNjc4Mzg4OA==","user":{"login":"robcowart","id":10326954,"node_id":"MDQ6VXNlcjEwMzI2OTU0","avatar_url":"https://avatars1.githubusercontent.com/u/10326954?v=4","gravatar_id":"","url":"https://api.github.com/users/robcowart","html_url":"https://github.com/robcowart","followers_url":"https://api.github.com/users/robcowart/followers","following_url":"https://api.github.com/users/robcowart/following{/other_user}","gists_url":"https://api.github.com/users/robcowart/gists{/gist_id}","starred_url":"https://api.github.com/users/robcowart/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/robcowart/subscriptions","organizations_url":"https://api.github.com/users/robcowart/orgs","repos_url":"https://api.github.com/users/robcowart/repos","events_url":"https://api.github.com/users/robcowart/events{/privacy}","received_events_url":"https://api.github.com/users/robcowart/received_events","type":"User","site_admin":false},"created_at":"2018-07-21T09:34:47Z","updated_at":"2018-07-21T09:34:47Z","author_association":"OWNER","body":"The `format 7` portion of the message refers to the sFlow record format. In this case `7` which is a LAG port statistics record. The sFlow codec (logstash-codec-sflow) on supports flow samples and counter samples (but not all counter types). The LAG Port Statistics type is not supported, and this is why you are getting this error.\r\n\r\n> NOTE: ElastiFlow is focused on network flows and only processes flow samples. It drops counter samples.\r\n\r\n```\r\n/* LAG Port Statistics - see IEEE8023-LAG-MIB */\r\n/* opaque = counter_data; enterprise = 0; format = 7 */\r\n\r\nstruct lag_port_stats {\r\n  mac dot3adAggPortActorSystemID;\r\n  mac dot3adAggPortPartnerOperSystemID;\r\n  unsigned int dot3adAggPortAttachedAggID;\r\n  opaque dot3adAggPortState[4]; /*\r\n                             Bytes are assigned in following order:\r\n                             byte 0, value dot3adAggPortActorAdminState\r\n                             byte 1, value dot3adAggPortActorOperState\r\n                             byte 2, value dot3adAggPortPartnerAdminState\r\n                             byte 3, value dot3adAggPortPartnerOperState\r\n                                 */\r\n  unsigned int dot3adAggPortStatsLACPDUsRx;\r\n  unsigned int dot3adAggPortStatsMarkerPDUsRx;\r\n  unsigned int dot3adAggPortStatsMarkerResponsePDUsRx;\r\n  unsigned int dot3adAggPortStatsUnknownRx;\r\n  unsigned int dot3adAggPortStatsIllegalRx;\r\n  unsigned int dot3adAggPortStatsLACPDUsTx;\r\n```\r\n\r\nThis would be unrelated to any bandwidth usage differences you may be seeing. Most likely this is related to dropped packets. I need to understand a bit more about your environment:\r\n\r\nHow many flows per second are you expecting to receive?\r\n\r\nExplain your ElastiFlow environment:\r\n\r\n- Single or multi-server?\r\n- CPU count?\r\n- RAM GB?\r\n- Storage Type (SSD, HDD, SAN, NAS)?\r\n- Storage Config (# disks, JBOD, RAID level)?\r\n\r\nRun `netstat -su` a couple times and check to see if the Receive Buffer Errors is incrementing excessively.\r\n"}}
{"actor":{"display_login":"robcowart"}}