Reports for Monitoring › Incidents Reports › Collector Incidents

Collector Incidents

The Collector Incidents page provides information about each incident reported against collector performance. Collector incidents identify problems that are local to a specific collector. The incidents help you detect and troubleshoot problems with SPAN port configuration and alert you to collector performance issues.

Collector incidents are not reported for Lync collectors that monitor Microsoft unified communications deployments. Only the Abnormal Termination incident applies to Avaya deployments.

Tip: Review the Collector Incidents page regularly to verify that SPAN ports are configured correctly and that the collectors in your system perform as expected.

The following information is provided in the Collector Incidents table. Detailed information is available when you click the linked incident ID number.

Acknowledged

Select the check box next to the incident that you want to acknowledge and click Apply. Acknowledging an incident lets other operators know that you are aware of the associated condition.

Collector

The host name or IP address of the collector where the incident was reported.

Duration

The length of time that the performance condition persisted.

ID

The sequential number that is assigned to this incident. Also a link to more information.

State

Whether the incident is Open or Closed.

Time

The date and time when the incident was reported.

Type

The type of collector incident. Corresponds to the collector threshold that was exceeded.

• Abnormal Termination. Indicates that a service on the collector logged a fatal exception. The path to the collector crash dump log file is provided.
• Discarded Packets. The percentage of discarded packets that exceeds the threshold. Traffic bursts can cause the collector to discard packets.
• Duplicate Packets. The percentage of traffic that was composed of duplicate packets exceeds the threshold. Usually indicates a SPAN port issue.
• Lost Bytes. The percentage of lost traffic that exceeds the threshold. Bytes of data are lost due to traffic bursts that exceed UC Monitor capacity for analysis. Some messages are too large to fit in one packet and are split into separate packets. Packets can also arrive out of order. To handle these situations, the collector reassembles packets using their sequence numbers. Missing sequence numbers indicate that expected bytes were not received. These bytes are counted as lost.
  
  A high number of lost bytes usually indicates a one-way spanning problem. The collector sees only the packets from one side of a conversation. Therefore, the collector counts the data flowing in the other direction as lost because it cannot see the data.