Reports for Monitoring › Incidents Reports › Collector Incidents › Collector Incident Details

Collector Incident Details

Two tables appear when you drill down from the Collector Incidents list:

• The Collector Incident Details table summarizes the incident-related information from the Collector Incidents list.
• The Collector Incident Metric Details table provides more information about the type of incident identified in the Type field in the Collector Incident Details table.

The following fields are available in the Collector Incident Metric Details table. The fields are specific to a particular type of collector incident.

Abnormal Termination Incident

• Dump File on Collector. The file name and path to a crash dump file that was created automatically in response to the collector service fatal exception event.
• Packet Capture on Collector. If available, the file name and path to a packet capture file that was created automatically in response to the collector service fatal exception event.

Discarded Packets Incident

Packets are discarded due to traffic bursts that exceed UC Monitor capacity for analysis. Packets are dropped when they arrive for processing but the collector is too busy to receive them.

• Total Number of Packets. The number of packets that were processed during the reporting interval when the incident was triggered.
• Discarded Packets (%). The amount of data that the collector discarded, expressed as a percentage of all packets that were processed during the reporting interval.

Duplicate Packets Incident

A problem at the monitored SPAN port causes packet duplication. Duplication can occur when a misconfigured SPAN sends packets to the collector twice.

Duplicate packets also indicate network problems. Packets are retransmitted when a response to a previous transmission is not received in time.

• Total Number of Packets. The number of packets that were processed during the reporting interval.
• Duplicate Packets (%). The amount of data that the collector treated as duplicated, expressed as a percentage of all packets that were processed during the reporting interval.
• Duplicate Packets. The amount of data that the collector treated as duplicated, expressed as a whole number. The total number of duplicate packets for the reporting interval.

Lost Bytes Incident

Bytes of data are lost due to traffic bursts that exceed UC Monitor capacity for analysis. Some messages are too large to fit in one packet and are split into separate packets. Packets can also arrive out of order. To handle these situations, the collector reassembles packets using their sequence numbers. Missing sequence numbers indicate that expected bytes were not received. These bytes are counted as lost.

A high number of lost bytes usually indicates a one-way spanning problem. The collector sees only the packets from one side of a conversation. Therefore, the collector counts the data flowing in the other direction as lost because it cannot see the data.

• Total Number of Bytes. The number of bytes that were processed during the reporting interval when the incident was triggered.
• Lost Bytes (%). The amount of data that the collector recorded as lost, expressed as a percentage of all bytes processed during the reporting interval.