Troubleshoot Deep Packet Analytics

This topic provides troubleshooting tips and best practices when using Deep Packet Analytics Rules. For more information about the Lua language, refer to this guide.

Syntax or Runtime Errors

If a Deep Packet Analytics Rule has syntax or runtime errors, the rule is disabled, the error type is displayed in the Deep Packet Analytics Rules table, and the error is logged. Based on the type of rule—packet or flow—errors are logged in either Logs > Engine or Logs > Logger.

2015/08/26 12:24:01 WARNING [LuaExecuter.cpp->GetLuaState:217] Deep Script thread #: 140459606185728 has syntax error for bad rule: newRule

To fix the syntax error, modify, enable and save the rule named in the log—see Edit Custom Deep Packet Analytics Rules. After saving, the rules are reloaded, and you can recheck the logs to verify if the syntax error has been fixed.

Avoid Packet Rules

Packet rules run every time a packet enters the system, which means they can consume a lot of resources in NetMon. If possible, use flow rules to alleviate the load on packet processing.

Timeout when Saving Rules

If a timeout occurs when trying to save a rule, check the Engine or Logger logs and look for something similar to the following:

2015/08/07 09:12:01 WARNING [SendStats.cpp->FireOffStatsMsg:213] Failed to send stat!

If the "Failed to send stat!" message appears, restart the NetMon core services as described in Restart NetMon Services.

Decreased Performance

Some Deep Packet Analytics Rules may consume more CPU and memory resources than others, and this can lead to some performance degradation. To help narrow down any performance issues, check the Diagnostics > Engine and Diagnostics > System pages.

These pages indicate if NetMon is dropping packets on the interface, if packets from the interface cannot be processed, or if high amounts of memory are being used. If any of these are true, you can try to disable recently added rules and see if system performance improves.