What is this?

This knowledgebase contains questions and answers about PRTG Network Monitor and network monitoring in general.

Learn more

PRTG Network Monitor

Intuitive to Use. Easy to manage.
More than 500,000 users rely on Paessler PRTG every day. Find out how you can reduce cost, increase QoS and ease planning, as well.

Free Download

Top Tags


View all Tags

Why do I get the message "The flow processor has dropped flows."?

Votes:

0

Why do I get the error message

The flow processor has dropped flows. The reason might be that PRTG is not able to process the incoming flows fast enough. To resolve this issue, consider using remote probes. Also try to optimize your include, exclude, and filter rules. For more information, see https://kb.paessler.com/en/topic/24973. (code: PE111)

What can I do to troubleshoot the issue?

jflow netflow prtg sflow xflow

Created on Sep 16, 2011 11:09:06 AM by  Torsten Lindner [Paessler Support]

Last change on Jan 17, 2023 7:11:00 AM by  Brandy Greger [Paessler Support]



1 Reply

Accepted Answer

Votes:

0

This article applies as of PRTG 22

Error because of dropped flows (PE111)

Reasons for PE111

This error occurs if PRTG is not able to process the incoming flows fast enough. To process a flow, PRTG first checks the include and exclude filters and then all the rules used for the channels.

Depending on the number of flows per second, the complexity of the rules and the processing power of the probe system, the error might be triggered.

Suggestions for troubleshooting

  1. Make sure that no other process is lowering system performance.
    Such processes can be scheduled tasks (like backups or virus scans) overloading the probe at specific times, or events like a search engine scan on your web server.
    The System Health sensor can help. Create a Windows Process sensor if you suspect a specific process.
  2. Check the complexity and number of rules that you use.
    If you use very long filter expressions, try to optimize them for faster evaluation. Put the most likely matches first, use brackets to structure the rule, and use IP address ranges and masks instead of separate IP addresses.
  3. Check your Toplists.
    Toplists need a lot of processing power, and can block the core-probe communication. Delete all Toplists that you do not need. Toplists with fewer fields are preferable. Disable live Toplists where they are not required.
  4. Use a remote probe on a separate system.
    Best performance can be achieved with a physical (non-virtual) system with four (or more) cores. Each sensor has its own flow processor that uses a thread, so more cores help if you have a lot of flow sensors.
  5. Use multiple remote probes.
    Distribute the load among multiple systems. If you have multiple routers, send the flow streams to different probes. If you have one router, you can send the same stream to two probes with only half the number of sensors.

Created on Sep 16, 2011 11:14:45 AM by  Torsten Lindner [Paessler Support]

Last change on Jan 17, 2023 7:24:55 AM by  Brandy Greger [Paessler Support]




Disclaimer: The information in the Paessler Knowledge Base comes without warranty of any kind. Use at your own risk. Before applying any instructions please exercise proper system administrator housekeeping. You must make sure that a proper backup of all your data is available.