tshark expired flow drops to zero then spikes

Has anyone seen an ingestion profile like such that the expired flow rate drops to zero, then spikes, and fails. See the attached. The event is happening at different intervals, but normally every 2 to 3 hours.

rgavin's avatar
1
rgavin
asked 2022-03-11 03:23:04 +0000
edit flag offensive 0 remove flag close merge delete

Comments

was not able to upload the data flow graph, but I have several that show the issue.

rgavin's avatar rgavin (2022-03-11 13:25:27 +0000) edit
more
  • delete

Could you give a bit more information since no image?

nelliott's avatar nelliott (2022-03-11 13:48:45 +0000) edit
more
  • delete

We are seeing this on multiple systems. We are not running out of memory or CPU. We are sending data into tshark as a pcap file written to stdin (with a -r flag).

hey - I know you! ;-)

Let me see if I can pull more details from the team.

rgavin's avatar rgavin (2022-03-11 18:21:56 +0000) edit
more
  • delete
add a comment see more comments