New Question
 
 
PRTG Network Monitor

Intuitive to Use.
Easy to manage.

200.000 administrators have chosen PRTG to monitor their network. Find out how you can reduce cost, increase QoS and ease planning, as well.

Free PRTG
Download >>

 

What is this?

This knowledgebase contains questions and answers about PRTG Network Monitor and network monitoring in general. You are invited to get involved by asking and answering questions!

Learn more

 

Top Tags


View all Tags


Why do I get the message "The flow processor has dropped flows."?

Votes:

0

Your Vote:

Up

Down

Why do I get the error message

The flow processor has dropped flows. Try optimizing your include, exclude and filter rules (Most likely matches first, use brackets to structure the rule, use ip ranges and masks instead of separate IPs) (code: PE111)?

What can I do to troubleshoot the issue?

jflow netflow prtg sflow xflow

Created on Sep 16, 2011 11:09:06 AM by  Torsten Lindner [Paessler Support]

Last change on Aug 2, 2019 6:05:10 AM by  Maike Behnsen [Paessler Support]



1 Reply

Accepted Answer

Votes:

0

Your Vote:

Up

Down

This article applies to PRTG Network Monitor 19 or later

Error because of Dropped Flows (PE111)

Reasons for PE111

Error PE111 happens if PRTG is not able to process the incoming flows fast enough. To process a flow, PRTG first has to check the include and exclude filter and then all the rules used for the channels. Depending on the number of flows per second, the complexity of the rules and the processing power of the probe system, the error might then be triggered sooner or later.

Suggestions for Troubleshooting

Try the following to resolve the issue:

  1. Make sure that no other process is lowering system performance.
    Such processes can be scheduled tasks (like backups or virus scans) overloading the probe at specific times, or events like a search engine scan on your web server.
    The System Health sensor can help here. Create a Windows Process sensor if you suspect a specific process.
  2. Check the complexity and number of rules that you use.
    If you use very long filter expressions, try to optimize them for faster evaluation. Put the most likely matches first, use brackets to structure the rule, and use IP ranges and masks instead of separate IPs.
  3. Check your toplists.
    Toplists need a lot of processing power, too, and can block the core-probe communication. Delete all toplists that you do not necessarily need. Toplists with fewer fields are preferable. Disable "live" toplists where they are not required.
  4. Use a remote probe on a separate machine.
    Best performance can be achieved with a physical (non-virtual) system with 4 (or more) cores. Each sensor has its own flow processor using a thread, so more cores help if you have a lot of Flow sensors.
  5. Use multiple remote probes.
    Distribute the load among multiple machines. If you have multiple routers, send the flow streams to different probes. If you have one router, you can send the same stream to two probes with only half the number of sensors.

Created on Sep 16, 2011 11:14:45 AM by  Torsten Lindner [Paessler Support]

Last change on Aug 2, 2019 6:18:16 AM by  Maike Behnsen [Paessler Support]



Please log in or register to enter your reply.


Disclaimer: The information in the Paessler Knowledge Base comes without warranty of any kind. Use at your own risk. Before applying any instructions please exercise proper system administrator housekeeping. You must make sure that a proper backup of all your data is available.