Syslog message

Unanswered Question
Sep 9th, 2008

Hi there. I'm receiving this syslog message thousands of times per day:


%C4K_SWNETFLOWMAN-6-FIXEDCREATIONTIME:


I looked up the message in the documentation and all it had to say was this:


Error Message C4K_SWNETFLOWMAN-6-FIXEDCREATIONTIME:Fixed creation time of [dec]

flows.


Explanation This message indicates that the system did not record the creation time of a flow. In this case, the system detemined a creation time, which is usually the same time that was used for the last flow.


Recommended Action If this message reoccurs frequently, and you see that the system is fixing a lot of flows, contact your technical support representative.


( http://www.cisco.com/en/US/docs/switches/lan/catalyst4500/12.2/25ew/system/message/emsg.html#wp1553607)


Does anyone have any other insight as to what this might be? I know it's netflow related, but I'm not sure what could be causing it.


Thanks in advance!

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (1 ratings)
Loading.
drolemc Mon, 09/15/2008 - 12:56

This message indicates that the system did not record the creation time of a flow. In this case, the system determined a creation time, which is usually the same time that was used for the last flow.


There are a few corner cases where the system misses to record the creation time of a flow. In this case, it uses its best judgment to come up with a creation time. Usually it is the same as the last seen time for the flow. This is not a cause of concern unless you see the system fixing this for a lot of flows.


The switch may also fall into this situation where the creation time provided by hardware is an invalid number. This is possible if a particular set of events occur, but is extremely rare. Moreover, it should not happen for large number of flows.

1. Are you enabling or disabling the netflow cache often (or did you do this in the past)?

2. From the flows which have been exported towards your NMS application do you see any anomalities in these (such as extreme large flows / strange times / ackward ip addressing etc..?

3. Would it be possible to perform a *soft* reset of the switch to see if the problem will be persisting? This by using the 'reload' command on the CLI, and * not * powering it physically down?

4. If the problem at this moment is still persisting and preset, please Continue with a *hard* reload of the switch (e.g. physically powering it down and bringing it up again) and see if the problem is still there or not.


Actions

This Discussion