08-27-2017 04:01 AM
HI all; for last week I am encountering following MSG.
Does not break functionality of the tool but its enoying, any advices out there ?
Reporting Volume, State: Red, Event: Reporting volume usage exceeds the licensed limit. threshold value: 113 - high value: 80 - low value:71
Solved! Go to Solution.
08-28-2017 07:32 PM
The message indicates that you have exceeded the maximum per day indexing capacity (allowed by the installed reporting license), by 13%. Threshold value: 113 - where 100 would mean 100% usage of the allowed indexing capacity.
If you login to the CLI of your reporting appliance and issue 'show license', the 'Reporting' license section should tell you the limit of the currently installed license. Following is an example from my lab and the value '2' (highlighted below) means 2GB/day.
License Type : Reporting (2)
Expiration Date : Permanent
License String : GwXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX==
If you have recently enabled indexing categories such as 'syslogs' or 'DNS Query Capture', I would recommend disabling them OR following some of the below to reduce the usage.
1. Disable reporting service on specific members on the grid, from which you do not wish to index any information.
2. Disable specific report categories, for which you do not wish to index any data.
3. If a sudden and significant increase in volume consumption is noticed from specific member(s) on the grid, perhaps make use of other available reports to analyze their DNS/DHCP traffic rate.
While I do not know the NIOS version running on your grid or the kind of reporting license (Enterprise OR trial) installed, 5 or more violations on an enterprise license and 3 or more violations on a trial license will cause the Reporting search function to be disabled for atleast the next 25 days OR until the violation count reaches below 5 (for Enterprise), in a rolling period of 30 days.
So my best recommendation would be to contain the situation and avoid search block. If you encounter a search block, please contact Infoblox Support and they should be able to fix the problem using a reset_license or by other available methods.
09-04-2017 02:30 AM
HI , decently this helped out.
Yes I have overun the capacity, disabling syslog indexing did fix the alerting but as you mentioned I need to reach out to Infoblox Support for reset_license. Thank you for your time.
09-11-2017 04:26 PM
We went down the same path. Reporter is working fine with the syslog turned off. The problem is we need syslog. Is there a magic formula some where to help us?
09-20-2017 02:53 AM
NIOS version 8.0 and newer support subscription based reporting licenses which can index 1, 2, 5, 10, 20, 50, 100, 200, and 500 GB per day. You may want to contact your Infoblox account team for availbility, setup, pricing and more information.
On the other hand you may try enabling syslog category only on the required members and verify if it still overwhelms your reporting license.
Additionally, under "Administration-->Reporting-->Grid Reporting Properties-->Syslog Data", you can specify the categories for which syslogs are to be forwarded. I would suggest picking required categories only instead of 'Send all' option.
However, the last time I reviewed this, found that the categories we specify under "Administration-->Reporting-->Grid Reporting Properties-->Syslog Data" does not take effect. The members continue to send everything. Hence I suggest you to pick required categories and apply them from "Grid-->Grid Manager-->Reporting-->Edit the required member(s)-->Syslog Data sidetab". It does take effect here.
If you find any anomalies, please contact Infoblox Support.
09-27-2017 12:20 PM
This is my solution to get around the syslog issue. Its still a work in progress, but I'm getting closer.