What is this?

This knowledgebase contains questions and answers about PRTG Network Monitor and network monitoring in general. You are invited to get involved by asking and answering questions!

Learn more

PRTG Network Monitor

Intuitive to Use. Easy to manage.
More than 500,000 users rely on Paessler PRTG every day. Find out how you can reduce cost, increase QoS and ease planning, as well.

Free Download

Top Tags

View all Tags

Why do I get the message "The flow processor has dropped flows."?



Your Vote:



Why do I get the error message

The flow processor has dropped flows. The reason might be that PRTG is not able to process the incoming flows fast enough. To resolve this issue, consider using remote probes. Also try to optimize your include, exclude, and filter rules. For more information, see https://kb.paessler.com/en/topic/24973. (code: PE111)

What can I do to troubleshoot the issue?

jflow netflow prtg sflow xflow

Created on Sep 16, 2011 11:09:06 AM by  Torsten Lindner [Paessler Support]

Last change on Nov 29, 2019 11:34:28 AM by  Maike Guba [Paessler Support]

1 Reply

Accepted Answer



Your Vote:



This article applies to PRTG Network Monitor 19 or later

Error because of Dropped Flows (PE111)

Reasons for PE111

Error PE111 happens if PRTG is not able to process the incoming flows fast enough. To process a flow, PRTG first has to check the include and exclude filter and then all the rules used for the channels. Depending on the number of flows per second, the complexity of the rules and the processing power of the probe system, the error might then be triggered sooner or later.

Suggestions for Troubleshooting

Try the following to resolve the issue:

  1. Make sure that no other process is lowering system performance.
    Such processes can be scheduled tasks (like backups or virus scans) overloading the probe at specific times, or events like a search engine scan on your web server.
    The System Health sensor can help here. Create a Windows Process sensor if you suspect a specific process.
  2. Check the complexity and number of rules that you use.
    If you use very long filter expressions, try to optimize them for faster evaluation. Put the most likely matches first, use brackets to structure the rule, and use IP ranges and masks instead of separate IPs.
  3. Check your toplists.
    Toplists need a lot of processing power, too, and can block the core-probe communication. Delete all toplists that you do not necessarily need. Toplists with fewer fields are preferable. Disable "live" toplists where they are not required.
  4. Use a remote probe on a separate machine.
    Best performance can be achieved with a physical (non-virtual) system with 4 (or more) cores. Each sensor has its own flow processor using a thread, so more cores help if you have a lot of Flow sensors.
  5. Use multiple remote probes.
    Distribute the load among multiple machines. If you have multiple routers, send the flow streams to different probes. If you have one router, you can send the same stream to two probes with only half the number of sensors.

Created on Sep 16, 2011 11:14:45 AM by  Torsten Lindner [Paessler Support]

Last change on Aug 2, 2019 6:18:16 AM by  Maike Guba [Paessler Support]

Please log in or register to enter your reply.

Disclaimer: The information in the Paessler Knowledge Base comes without warranty of any kind. Use at your own risk. Before applying any instructions please exercise proper system administrator housekeeping. You must make sure that a proper backup of all your data is available.