This article applies as of PRTG 22
Error because of dropped flows (PE111)
Reasons for PE111
This error occurs if PRTG is not able to process the incoming flows fast enough. To process a flow, PRTG first checks the include and exclude filters and then all the rules used for the channels.
Depending on the number of flows per second, the complexity of the rules and the processing power of the probe system, the error might be triggered.
Suggestions for troubleshooting
- Make sure that no other process is lowering system performance.
Such processes can be scheduled tasks (like backups or virus scans) overloading the probe at specific times, or events like a search engine scan on your web server.
The System Health sensor can help. Create a Windows Process sensor if you suspect a specific process.
- Check the complexity and number of rules that you use.
If you use very long filter expressions, try to optimize them for faster evaluation. Put the most likely matches first, use brackets to structure the rule, and use IP address ranges and masks instead of separate IP addresses.
- Check your Toplists.
Toplists need a lot of processing power, and can block the core-probe communication. Delete all Toplists that you do not need. Toplists with fewer fields are preferable. Disable live Toplists where they are not required.
- Use a remote probe on a separate system.
Best performance can be achieved with a physical (non-virtual) system with four (or more) cores. Each sensor has its own flow processor that uses a thread, so more cores help if you have a lot of flow sensors.
- Use multiple remote probes.
Distribute the load among multiple systems. If you have multiple routers, send the flow streams to different probes. If you have one router, you can send the same stream to two probes with only half the number of sensors.
Add comment