Null
The interface traffic is captured in the field by sFlow method, and there is no data in the interface traffic. Capture packets can see sFlow packets. Normally, there should be a .csv file in the \iMC\data\recieverData\ directory, but there is no file in this directory.
To check whether the sflow function is correctly configured on the device and is running normally, execute the command display sflow.
Currently, sflow has two sampling modes, one is called flow sampling and the other is called counter sampling, but currently NTA/UBA only supports flow mode sampling. Therefore, when configuring the device, be sure to select flow mode for sampling. If you choose counter mode, NTA cannot get the flow. As shown in the figure:
After investigation, both Counter sampling and Flow sampling are configured. Try to only keep the flow mode, and the problem will be solved.
When using sflow to collect interface traffic, Counter sampling and Flow sampling modes cannot be configured simultaneously. Only the flow mode should be kept in order to view traffic data normally.