Gigamon flows are truncated at 1024 bytes

To prevent processing errors due to truncated data in processing Gigamon flows, you must set the value of the QRadar parameter SV_IPFIX_METADATA_ENCODING_LENGTH to more than 1024.

Procedure

  1. Use SSH to log in to your QRadar Console appliance as a root user.
  2. Open the following file for editing: /store/configservices/staging/globalconfig/nva.conf
  3. Add the SV_IPFIX_METADATA_ENCODING_LENGTH parameter and set the value to more than 1024, depending on your system configurations and flow capacity.
  4. Save the nva.conf file and exit the SSH session.
  5. Log in to the QRadar Console appliance.
  6. Click the Admin tab, and then click Deploy Changes.