Table Of Contents
Release Notes for Cisco CNS NetFlow Collection Engine, 5.0.3
These release notes provide information about new features in the CNS NetFlow Collection Engine 5.0.3 release. The CNS NetFlow Collection Engine application is used with the NetFlow services data export feature on Cisco routers and Catalyst 5000 and 6000 series switches. CNS NetFlow Collection Engine provides fast, scalable, and economical data collection from multiple export devices exporting NetFlow data records.
In previous releases, this product was referred to as Cisco NetFlow FlowCollector (NFC).
This release note contains the following sections:
Patches and Updates for Release 5.0.3
Due to Daylight Saving Time (DST) changes in Australia in 2006 and in the United States in 2007, the time zone information files contained in the Java Runtime Environment bundled with NetFlow Collection Engine should be updated with Cisco NetFlow Collection Engine 5.0.3 Patch 1.
You can download this patch from Cisco.com:
Refer to the Readme files with the patch for installation instructions.
Note that this patch updates DST information for Cisco NetFlow Collection engine only, not the underlying operating system.
Unless Cisco NetFlow Collection Engine is configured to use GMT or anther non-Daylight Saving Time time zone, NetFlow Collection Engine will aggregate data for the entire hour prior to the transition from DST to standard time. Otherwise, NetFlow Collection Engine output files would be overwritten when local time is turned back one hour. If desired, this behavior can be changed by applying an engineering patch. Contact Cisco Technical Support for additional information.
What Is New
What Is New In Release 5.0.3
The following were added or addressed in CNS NetFlow Collection Engine, Release 5.0.3:
•Support for rolling log files. Refer to the section "NetFlow Collection Engine Logger Configuration" in the CNS NetFlow Collection Engine User Guide for more information.
What Is New In Release 5.0.2
The following features were added in CNS NetFlow Collection Engine, Release 5.0.2:
•Configuration enhancements in the web UI. The following CNS NetFlow Collection Engine components can now be configured via web UI: fields, key/value builders, filters of multiple logic levels, NDE source groups, NDE source access lists, BGP Peer, and Report Generator. For most features, users no longer have to edit XML configuration files.
•Feature and performance improvements in the CNS NetFlow Collection Engine BGP peer; any BGP-4 attribute and the complete AS path can now be included in aggregation output.
•More than one scheduled report can now be created, managed, and displayed through the web UI. A command-line tool is provided for creating reports.
•The others row can now optionally be excluded from reports.
•Post-processing scripts for BGP attributes and DNS lookups have been eliminated in favor of a key builder-based approach with better performance.
•Option data correlated from flow data can now be incorporated in aggregation output.
•The need for starting a virtual frame buffer program is eliminated.
•Null/empty column values in output are now optionally allowed if the user wants to aggregate flows that are missing one or more fields of interest.
•Memory allowance configuration for CNS NetFlow Collection Engine processes has been moved to the config/nfcmem file from the start-process scripts.
What Is New In Release 5.0 and 5.0.1
The following features were added in CNS NetFlow Collection Engine, Release 5.0 and 5.0.1:
•Web-Based User Interface: Web-based UI for configuration, control, status, and reporting.
•Report generator: Creates customized reports based on CNS NetFlow Collection Engine output files.
•BGP peer: Passive BGP peer that supplements CNS NetFlow Collection Engine output with BGP attributes.
•Interface name support: Option to output interface names.
•MPLS/VPN PE-PE traffic reports: Hourly or daily PE-PE traffic matrix for an MPLS provider network. This feature requires Cisco CNS Performance Engine, Release 2.1 in addition to CNS NetFlow Collection Engine, Release 5.0.
•DNS lookup: Option to output host names instead of IP addresses.
•MPLS EXP field support: Option to extract EXP bits from MPLS labels for use as an aggregation key.
•NDE V5 sampled Netflow header support: Option to output the sampling information from NDE V5 headers.
•Max burst rate: Option to output max burst rate associated with each aggregation data record.
•XML-based configuration: New XML configuration format is introduced that replaces the configuration format from previous releases.
•All aggregation now cafeteria-style: Cafeteria-style definitions for all fixed aggregation schemes in previous releases are provided, but these definitions can be changed as needed or used as the basis for creating new aggregation schemes.
•Optional XML header for output files: New header format contains additional information that allows all output files to be parsed generically. The previous header format can still be configured for backwards compatibility.
•Enhancements to field mapping: Any field can be mapped, including address fields. Any number of field values and ranges of values can be associated with a single mapped value. A combination of values from multiple fields can associated with a single label value. Mapping efficiency has been improved.
•Enhancements to filtering: Filtering can be done on any field, as well as on the source router address. Filter syntax has been changed to be more intuitive; the logical operators equals, not equals, and, and or are now supported. Nested filter expressions of arbitrary complexity are supported.
•Artificial limitations are not imposed on the numbers of aggregators and ports, name lengths, etc. Only system resources such as memory will limit what can be configured.
•A new feature called packet logging replaces CNS NetFlow Collection Engine 3.x/4.0-style raw flows aggregation. The packet log can be enabled for individual aggregators, and contains all data that was received on a particular port. A tool is provided for displaying the contents of the packet log.
•Enhancement to logging: each log message bears a time stamp.
•Linux SMP support: CNS NetFlow Collection Engine supports the Red Hat Enterprise multiprocessor kernel.
Changes to the CNS NetFlow Collection Engine Configuration
Several minor updates to the CNS NetFlow Collection Engine 5.0 and 5.0.1 XML configuration format have been made in CNS NetFlow Collection Engine, 5.0.2. The updates reflect new feature content introduced in this release. A migration for most of these changes is performed automatically at installation time. However, in a few cases, the update cannot be made automatically; in that case, you will be notified during the installation.
The following configuration updates from CNS NetFlow Collection Engine 5.0 and 5.0.1 to 5.0.2 are performed automatically during installation:
•The global setting ipaddress-output-format is removed. Output format is now set on individual builder instances and through the web-based user interface. Note that support for integer format IPV4 addresses is provided for backwards compatibility and will be removed in a coming release.
•The global settings disk-usage-threshold and disk-usage-clear-threshold are removed. Setting these had no effect in earlier releases because the disk usage check was not implemented. Note that the capability is implemented in CNS NetFlow Collection Engine 5.0.2 and is configured with the disk-usage-monitor setting. You must configure this setting as appropriate for their environment
•The global setting is-output-header-xml is replaced by the global setting output-format, that can be configured to one of the following:
–csv-only for CNS NetFlow Collection Engine, 4.0 compatible outpu.t
–mixed for an XML header with CSV data.
–xml-only for all XML output. This is new in CNS NetFlow Collection Engine, 5.0.2.
•The listener-packet-pool-size attribute of default-flow-reader is removed. The number of pool entries allocated is now determined by the UDP_READER_POOL_ENTRIES setting in /opt/CSCOnfc/config/nfcmem, where all memory-related settings have been consolidated.
•The filter-related type name mapped-value-filter-condition has been renamed string-filter-condition, as a result of the introduction of string field types in NetFlow data.
•The asn global element in BGP peer configuration is now ignored in favor of the peer-asn element that is now required for each session.
•The thread element in report configuration is now called aggregator, although both are supported in this release for compatibility.
A warning message is displayed during installation for the following configuration updates from 5.0 and 5.0.1 to 5.0.2 that must be performed by editing the nfc-config.xml file:
•Field aliases that were defined separately in field-info in versions 5.0 and 5.0.1 must now be defined within individual field elements. See the chapter "Customizing the CNS NetFlow Collection Engine" in the CNS NetFlow Collection Engine User Guide for more information.
•The BGP and DNS (hostname) post-processing scripts have been replaced with key builder implementations that have improved performance characteristics. Be aware of the following:
–The post-processing scripts are removed.
–New BGP attribute key builders are introduced.
–Hostname mapping is now configured as a format option for address key builders.
See the chapter "Customizing the CNS NetFlow Collection Engine" in the CNS NetFlow Collection Engine User Guide for more information.
Table 2 lists the problems that were resolved in CNS NetFlow Collection Engine, Release 5.0.3. Table 2 lists the problems that were resolved in CNS NetFlow Collection Engine, Release 5.0.2. Table 3 lists the problems that were resolved in Release 5.0.1. Table 4 lists the problems that were resolved in Release 5.0.
This section lists known problems that are open for release 5.0.2 of the CNS NetFlow Collection Engine.
CSCef75063— migrateConfig.sh tool broken with NFC 4.x to NFC 5.x
Description: Migration tool with CNS NetFlow Collection Engine 5 fails to migrate CNS NetFlow Collection Engine 4 XML config file correctly. A number of cases have been reported where the tool does not properly do the conversion; after the migration, CNS NetFlow Collection Engine cannot be started and a configuration error is reported in nfc.log. This is primarily because of the unstructured nature of CNS NetFlow Collection Engine 3.x and 4.0 configuration, which makes it difficult for the tool to cover all possible syntax variations.
Workaround: Use the web UI in CNS NetFlow Collection Engine 5.0.2 to enter equivalent configuration, or contact Cisco support to assist with the migration.
CSCeh08083—collector:nfcollector stop all can be run as root
Description: Whereas the nfcollector script prevents users from starting CNS NetFlow Collection Engine other than one designated as owning CNS NetFlow Collection Engine at installation time, any user can shut down CNS NetFlow Collection Engine. (CNS NetFlow Collection Engine 3.x and 4.0 also allowed other users to shut down CNS NetFlow Collection Engine.)
Workaround: The system administrator should be aware of this behavior, and can remove execute permissions for group and/or other for selected files in the CNS NetFlow Collection Engine bin directory as needed.
CSCin87712—Config:Check Validity of source-name in NDE source access list
Description: When adding a hostname to the NDE source access list through the web UI, the validity of the hostname is not checked. This is subsequently flagged as a configuration error the next time the collector is restarted.
Workaround: Ensure the validity of hostnames when entering names for the NDE source access list; or specify IP addresses not hostnames for the access list.
CSCin86968—The GUI Blocks. There is a log in NFC.log for the exhausted memory
Description: Under certain conditions when the main collector process exhausts the memory available to it due to a capacity planning issue, the web UI becomes unresponsive. Logs indicating the memory issue are generated.
Workaround: If logs indicating an out-of-memory issue are observed, increase the amount of memory available for the collector process, or decrease the amount of data being sent to the collector. Refer to the "Tuning Memory Usage" section in the CNS NetFlow Collection Engine User Guide for additional details.
CSCin87299—Aggregated data stored in faulty location
Description: If the aggregation scheme associated with an aggregator is changed while the aggregator is active and collecting data, a partial file is written when the aggregator is updated. However the pathname of the partial file contains the new aggregation scheme name not the previous name as expected.
Workaround: Set an aggregator's state to inactive before changing the aggregation scheme associated with it.
CSCef04102—scripts: wait for config to be parsed successfully
Description: When nfcollector start all is run, the collector status can be shown as running even though a fatal configuration error has occurred. This is because the nfcollector script waits only a few seconds before displaying status and returning, and because there is no indication from the collector to the process watcher that startup has succeeded.
Workaround: Check collector status again and check the nfc.log for the collector started log if the collector appears to not have been started successfully.
CSCeh06905—UI: add screen shown for source group after host error on modify
Description: The Add page is shown for an existing source group instead of the Modify page when editing a group, after an invalid hostname is entered. Then the group can no longer be edited in the Add screen because it already exists.
Workaround: Reselect the group from the navigation tree or group list and enter the valid hostname.
CSCeh21403—Pass IP address string to SNMP Java API
Description: For the Interface Name mapping feature, the following error is reported:ERROR com.cisco.nfc.collector.ifcache.InterfaceNameCache - Error in adding community string: For input strng: <name>.
A bug in the underlying SNMP library causes an IP address to be converted to a hostname then improperly interprets a four-part domain-qualified hostname. For example, . a.b.c.com as an IP address.
Workaround: None known. Contact Cisco support for information.
CSCin87029— Date format label in Custom reports has to be Updated
Description: In the custom report UI, the date format in the label of the Start/End Date is displayed as dd-MMM-yyyy, but the correct date format is actually dd Mmm yyyy. This is misleading.
Workaround: Use the correct date format dd Mmm yyyy when you input the Start/End Date.
CSCin58493—Consistency check for Cleanup Job file in UI
Description: From the user interface Global Properties window: there is no check for the presence of the file for Clean Up Job. The UI takes any input string and does not check if it is a file and present.
Workaround: Make sure the input is indeed the file name of the clean-up script that exists.
CNS NetFlow Collection Engine, Release 5.0.2 has the following hardware requirements:
•Minimum of 1 GB RAM, 10K SCSI, 30 GB disk, single processor on an entry-level server.
•Recommended: 4 GB RAM, 15K Ultra 320 SCSI, dual 70 GB disks, dual processors on an entry-level server.
The following operating systems and platforms are supported:
•Solaris 8 and Solaris 9 on an entry-level server, such as the Sun Fire 280R with 1 GHz or greater UltraSPARC III or IIIi processors.
•HP-UX Version 11i for PA-RISC on an entry-level server, such as the rp2400 series.
•Red Hat Enterprise Linux 2.1 or 3 ES on an entry-level server, such as an IBM x336 with 2.2 GHz or greater Intel Xeon processors.
Note that the CPU, RAM, and disk space recommendations above are minimum requirements, and that actual requirements are determined by your configuration and by the volume and uniqueness of NetFlow data that is received. Actual resource usage can vary greatly depending on these factors.
Note To prevent NetFlow data export packet loss, the workstation should be dedicated to the CNS NetFlow Collections Engine and should not be running other applications.
CNS NetFlow Collection Engine generates output files containing aggregated data. The exact amount of disk space that they require depends on the flow arrival rate, collection interval, number of aggregation schemes specified, use of compression or not, and data file retention policies.
For more information on planning and managing disk space usage, see the section about Managing Disk Space in Chapter 5 of the Cisco CNS NetFlow Collection Engine and User Guide.
The CNS NetFlow Collection Engine, Release 5.0 web-based user interface is compatible with Microsoft Internet Explorer 6.0.28, and Netscape Navigator 7.0.1 on Windows or UNIX. The web-based UI requires that the browser support a Java virtual machine (JVM) to run applets. Either the Microsoft JVM or the Sun JVM can be used. The JVM version must be 1.4.1_02 or higher.
NetFlow Services and IOS Release Support
CNS NetFlow Collection Engine functionality is currently available with the following Cisco devices:
•Catalyst 5000 series switches equipped with a NetFlow feature card (NFFC)
•Catalyst 6000 series switches
You can find the most up-to-date information available to help you determine the compatibility among different Cisco hardware platforms, Cisco IOS software releases, and supported NetFlow data export versions at the following URL:
Use these Release Notes with the Cisco CNS NetFlow Collection Engine Installation and Configuration Guide, Part Number OL-6900-01 and the Cisco CNS NetFlow Collection Engine User Guide, Part Number OL-6899-01. These documents are available online through Cisco Connection Online at the following URL:
Cisco documentation and additional literature are available on Cisco.com. Cisco also provides several ways to obtain technical assistance and other technical resources. These sections explain how to obtain technical information from Cisco Systems.
You can access the most current Cisco documentation at this URL:
You can access the Cisco website at this URL:
You can access international Cisco websites at this URL:
You can find instructions for ordering documentation at this URL:
You can order Cisco documentation in these ways:
•Registered Cisco.com users (Cisco direct customers) can order Cisco product documentation from the Ordering tool:
•Nonregistered Cisco.com users can order documentation through a local account representative by calling Cisco Systems Corporate Headquarters (California, USA) at 408 526-7208 or, elsewhere in North America, by calling 1 800 553-NETS (6387).
You can send comments about technical documentation to email@example.com.
You can submit comments by using the response card (if present) behind the front cover of your document or by writing to the following address:
Attn: Customer Document Ordering
170 West Tasman Drive
San Jose, CA 95134-9883
We appreciate your comments.
Obtaining Technical Assistance
For all customers, partners, resellers, and distributors who hold valid Cisco service contracts, Cisco Technical Support provides 24-hour-a-day, award-winning technical assistance. The Cisco Technical Support Website on Cisco.com features extensive online support resources. In addition, Cisco Technical Assistance Center (TAC) engineers provide telephone support. If you do not hold a valid Cisco service contract, contact your reseller.
Cisco Technical Support Website
The Cisco Technical Support Website provides online documents and tools for troubleshooting and resolving technical issues with Cisco products and technologies. The website is available 24 hours a day, 365 days a year, at this URL:
Access to all tools on the Cisco Technical Support Website requires a Cisco.com user ID and password. If you have a valid service contract but do not have a user ID or password, you can register at this URL:
Note Use the Cisco Product Identification (CPI) tool to locate your product serial number before submitting a web or phone request for service. You can access the CPI tool from the Cisco Technical Support Website by clicking the Tools & Resources link under Documentation & Tools. Choose Cisco Product Identification Tool from the Alphabetical Index drop-down list, or click the Cisco Product Identification Tool link under Alerts & RMAs. The CPI tool offers three search options: by product ID or model name; by tree view; or for certain products, by copying and pasting show command output. Search results show an illustration of your product with the serial number label location highlighted. Locate the serial number label on your product and record the information before placing a service call.
Submitting a Service Request
Using the online TAC Service Request Tool is the fastest way to open S3 and S4 service requests. (S3 and S4 service requests are those in which your network is minimally impaired or for which you require product information.) After you describe your situation, the TAC Service Request Tool provides recommended solutions. If your issue is not resolved using the recommended resources, your service request is assigned to a Cisco TAC engineer. The TAC Service Request Tool is located at this URL:
For S1 or S2 service requests or if you do not have Internet access, contact the Cisco TAC by telephone. (S1 or S2 service requests are those in which your production network is down or severely degraded.) Cisco TAC engineers are assigned immediately to S1 and S2 service requests to help keep your business operations running smoothly.
To open a service request by telephone, use one of the following numbers:
Asia-Pacific: +61 2 8446 7411 (Australia: 1 800 805 227)
EMEA: +32 2 704 55 55
USA: 1 800 553-2447
For a complete list of Cisco TAC contacts, go to this URL:
Definitions of Service Request Severity
To ensure that all service requests are reported in a standard format, Cisco has established severity definitions.
Severity 1 (S1)—Your network is "down," or there is a critical impact to your business operations. You and Cisco will commit all necessary resources around the clock to resolve the situation.
Severity 2 (S2)—Operation of an existing network is severely degraded, or significant aspects of your business operation are negatively affected by inadequate performance of Cisco products. You and Cisco will commit full-time resources during normal business hours to resolve the situation.
Severity 3 (S3)—Operational performance of your network is impaired, but most business operations remain functional. You and Cisco will commit resources during normal business hours to restore service to satisfactory levels.
Severity 4 (S4)—You require information or assistance with Cisco product capabilities, installation, or configuration. There is little or no effect on your business operations.
Obtaining Additional Publications and Information
Information about Cisco products, technologies, and network solutions is available from various online and printed sources.
•Cisco Marketplace provides a variety of Cisco books, reference guides, and logo merchandise. Visit Cisco Marketplace, the company store, at this URL:
•The Cisco Product Catalog describes the networking products offered by Cisco Systems, as well as ordering and customer support services. Access the Cisco Product Catalog at this URL:
•Cisco Press publishes a wide range of general networking, training and certification titles. Both new and experienced users will benefit from these publications. For current Cisco Press titles and other information, go to Cisco Press at this URL:
•Packet magazine is the Cisco Systems technical user magazine for maximizing Internet and networking investments. Each quarter, Packet delivers coverage of the latest industry trends, technology breakthroughs, and Cisco products and solutions, as well as network deployment and troubleshooting tips, configuration examples, customer case studies, certification and training information, and links to scores of in-depth online resources. You can access Packet magazine at this URL:
•iQ Magazine is the quarterly publication from Cisco Systems designed to help growing companies learn how they can use technology to increase revenue, streamline their business, and expand services. The publication identifies the challenges facing these companies and the technologies to help solve them, using real-world case studies and business strategies to help readers make sound technology investment decisions. You can access iQ Magazine at this URL:
•Internet Protocol Journal is a quarterly journal published by Cisco Systems for engineering professionals involved in designing, developing, and operating public and private internets and intranets. You can access the Internet Protocol Journal at this URL:
•World-class networking training is available from Cisco. You can view current offerings at this URL:
This document is to be used in conjunction with the documents listed in the "Related Documentation" section.
Copyright © 2006 Cisco Systems, Inc. All rights reserved.