Cisco 3850/IP Base/IOS XE 3.7.2
I was going over my NetFlow data, and it seemed I was only catching flow in, and not out. I already had the in/out records and monitors, using the same exporter to one sensor in the monitoring suite. I set up another sensor on the monitoring software, using the next numerical port. It worked as intended for about 5 minutes, then stopped transmitting.
What am I missing here? the In exporter is using 2055, the Out using 2056. This was done to allow separate sensors in software. It did work for a few minutes and then it quit. There definitely seems to be a change, as the still working NetFlow sensor shows highly reduced traffic.
flow record Ripon-Core-In match ipv4 tos match ipv4 protocol match ipv4 source address match ipv4 destination address match transport source-port match transport destination-port match interface input collect counter bytes long collect counter packets long ! ! flow record Ripon-Core-Out match ipv4 tos match ipv4 protocol match ipv4 source address match ipv4 destination address match transport source-port match transport destination-port match interface output collect counter bytes long collect counter packets long ! ! flow exporter Ripon-Core destination 10.2.225.65 source Vlan110 transport udp 2055 ! ! flow exporter Ripon-Core-Out destination 10.2.225.65 source Vlan110 transport udp 2056 ! ! flow monitor Ripon-Core-In exporter Ripon-Core cache timeout active 900 record Ripon-Core-In ! ! flow monitor Ripon-Core-Out exporter Ripon-Core-Out cache timeout active 900 record Ripon-Core-Out
sho flow exporter status:
Flow Exporter Ripon-Core: Packet send statistics (last cleared 2w2d ago): Successfully sent: 2666339 (3097186452 bytes) Client send statistics: Client: Flow Monitor Ripon-Core-In Records added: 41619483 - sent: 41619483 Bytes added: 1415062422 - sent: 1415062422 Flow Exporter Ripon-Core-Out: Packet send statistics (last cleared 00:48:04 ago): Successfully sent: 60 (70098 bytes) Client send statistics: Client: Flow Monitor Ripon-Core-Out Records added: 1893 - sent: 1893 Bytes added: 64362 - sent: 64362
and the port to which it is applied:
interface TenGigabitEthernet1/0/12 switchport access vlan 110 switchport mode access ip flow monitor Ripon-Core-In input ip flow monitor Ripon-Core-Out output`