Netflow error - reason 4

[corey]

We recently stopped receiving netflow from one of our devices after it had been rebooted.  The configuration was written before the reload and the config still looks correct.  A debug ip flow export shows:

010023: *Oct 22 10:17:43.230 CDT: IPFLOW: Sending export pak 426805 to 10.10.10.10 port 2055 reason 4

..and it's always "reason 4".  Does anyone know what reason 4 means, and more importantly, what do I need to do to get netflow working again?

[Giuseppe Larosa]

Hello Corey,

may you post more details?

what device is involved? ( model)

what IOS image is running on it?

show ver | inc image

Hope to help

Giuseppe

[corey]

Sure, it's a 2801 running IOS 12.3(14)T6

c2801-advsecurityk9-mz.123-14.T6.bin

Let me know if there's anything else I can provide.

[Giuseppe Larosa]

Hello Corey,

may you provide the netflow configuration?

the debug is simply listed here

http://www.cisco.com/en/US/customer/docs/ios/debug/command/reference/db_h1.html#wp1021807

but no mention of meaning of error codes

usually after a reload there may be issues on the collector side not on the router side .

Hope to help

Giuseppe

[corey]

sh run | i flow

ip route-cache flow

ip route-cache flow

ip route-cache flow

ip flow-export source Serial0/3/0:0
ip flow-export version 5
ip flow-export destination 10.10.10.11 9996
ip flow-export destination 10.10.10.10 2055

The "ip route-cache flow" statements are on the interfaces we're monitoring.  The debug statement does not give errors exporting to the 10.10.10.11 (Aruba) address and it was definitely working to 10.10.10.10 (Orion) before the reload. Aruba is seeing the netflow data, Orion is not.

[Giuseppe Larosa · Accepted solution]

Hello Corey,

dual netflow export, one is working and the other is not.

check if you can reach the intended destinations (I guess that the ip addresses here are place holders otherwise both aruba and orion are in the same IP subnet)

It may be a software bug related to dual export

feature navigator confirms support for multiple export in your device with this current IOS image

Netflow Multiple Export Destinations

http://www.cisco.com/go/fn

what if you delete the line and you add it again ?

no ip flow-export destination 10.10.10.10 2055

ip flow-export destination 10.10.10.10 2055

edit:

I tried to search with bug toolkit but I didn't find a match

Hope to help

Giuseppe

[corey]

THe IP's are placeholders, but they are on the same subnet, too.  (one is being phased out.)

Anyway, I had previously removed the 10.10.10.10 address and re-added it like you suggested, but still had the error.  But your post got me thinking - so I removed both and added just the 10.10.10.10 destination back in and it's working.  If I added the second destination it gets the "reason 4" error as well.

So, I seem to have an issue with the dual-export, but since one of my destinations is going away anyway, I think I'll just make it go away now and be done.

Thanks for your help!

[Giuseppe Larosa]

Hello Corey,

for several years dual export of neflow had been not supported, so it is not something to be considered part of basic netflow feature

if your final objective is to have only one destination you are fine

Hope to help

Giuseppe