FAQ

To quickly look up answers to frequently asked questions, select a category:

Important

For additional questions or concerns, contact Plixer Technical Support.

Plixer Scrutinizer core system

Q) Can we try Plixer Scrutinizer before paying for a full subscription?

A) To try out Plixer Scrutinizer or any other Plixer product, contact Plixer Technical Support and ask about an evaluation license.

Q) How do I view the details of our current Plixer Scrutinizer license?

A) To add a new license or view the details of the currently applied Plixer Scrutinizer license, navigate to the Admin > Plixer > Licensing page.

Q) What happens when a license key expires?

A) Evaluation keys will cease to function after their expiry date. Plixer Scrutinizer subscription keys include a 60-day grace period where data collection continues on, but access to the data is unavailable until a new key is added. Legacy perpetual licenses will never expire, but deployments they are applied to cannot be upgraded.

Q) Is Plixer Scrutinizer available in other languages?

A) The Plixer Scrutinizer web interface supports localization to other languages via the Admin > Definitions > Language page.

Q) What does it mean when we get an unexpected inconsistency error while trying to power on our Plixer Scrutinizer ESXi virtual appliance?

A) An unexpected inconsistency error during the ESXi virtual appliance startup indicates that the server clock is not correctly set, resulting in the disk checks failing. To resolve this issue, set your ESXi host to sync with an NTP server and then redeploy the Plixer Scrutinizer OVF.

Q) How do I stop or start Plixer Scrutinizer services?

A) To stop or start individual services, use the following command:

SCRUTINIZER> services <service_name | all> <stop | start>

Valid service_name values:

  • plixer_flow_collector

  • plixer_syslogd

  • httpd

  • plixer_db

Q) Why am I unable to log in to the appliance using the default scrutinizer password?

A) If you have yet to change the password for the plixer user and are unable to log in with the password scrutinizer check if caps lock is turned on. Additionally, if you are using a keyboard with a non-ANSI layout, you will need to enter the password using the same key positions as a standard ANSI keyboard (e.g. scrutiniyer on QWERTZ keyboards).

Q) I got locked out of my account after several failed log-in attempts. How can I log back in to the web interface?

A) When an account is locked due to multiple failed logins, there are two methods that an Admin user can use unlock it:

  • In the web interface, go to Admin > Security > Users. Select the locked username/account, click the Authentication Method tab in the Edit User modal, and then change the Authentication Method from ‘locked’ to the appropriate method.

  • Launch the scrut_util utility and enter the following command at the SCRUTINIZER> prompt:

    unlock [username] <auth_method>

Q) Why is the backup file we used to perform an instance restore missing?

A) In addition to overwriting the Plixer Scrutinizer instance the backup was restored to, the restore script is also set to delete the backup file used to perform the operation. As such, it is best to always create a copy of the backup file before initiating a restore.

Q) Why is the Aggregated Alarm Timeout setting missing for certain FA algorithms?

A) Not all FA algorithms support (or benefit from) Aggregated Alarms. The Aggregated Alarm Timeout setting is only available for algorithms with continuous Alarm Events that can be combined.

Q) What do I do if I forgot to assign a static MAC address to the Plixer Scrutinizer NIC?

A) If this happens when deploying virtual appliance to a distributed cluster, contact Plixer Technical Support. to obtain a new license key.

Q) How do I free up disk space on my Plixer Scrutinizer server?

A) Historical data can be trimmed to free up disk space. You can do either of the following:

  • In the web interface, go to Admin > Settings > Data History, and then adjust the current retention settings.

  • Launch the scrut_util utility and enter the following command at the SCRUTINIZER> prompt:

    SCRUTINIZER> expire history

Plixer Replicator integration

Q: If a new Collector is added to the distributed Plixer Scrutinizer cluster, will it automatically be included under auto-replication/load balancing?

A: After adding a new Plixer Scrutinizer Collector to the distributed cluster, the configuration file will need to be updated. After that, either run scrut_util --autoreplicate again or wait for the next scheduled run, if configured.

Q: What happens when auto-replication is enabled and a Collector goes down? Will Plixer Replicator detect the offline Collector and automatically re-balance flows?

A: If a Plixer Scrutinizer Collector goes offline while auto-replication is enabled, the configuration file should be updated. After that, either run scrut_util --autoreplicate again or wait for the next scheduled run (if configured) for the flows to be re-balanced across the available Collectors.

Q: Why do the flows being sent to our distributed cluster seem unbalanced? Shouldn’t auto-replicate distribute load evenly across all configured Collectors?

A: Because every Exporter sends flows at a different rate that changes throughout the day, a rate of 200 flows/s is assumed for each Exporter added to a Collector. An Exporter’s flows will only be reassigned when a Collector exceeds its defined inbound limits as the real rates are observed.

Q: How does the auto-replicate function assign new Exporters to Collectors in a distributed cluster?

A: Exporters are automatically distributed across the Collectors in the cluster using a “round-robin” system until Collectors reach their defined flow rate limits.

Q: When a Collector becomes over-provisioned, how does the system determine which Collector the Exporter will be moved to?

A: When a Collector reaches or exceeds its flow limits, it will be excluded from the round robin and additional Exporters will be assigned to other available Collectors defined in the autoreplicate.conf file.

Q: Our auto-replicate Collector threshold is set to 40,000 flows/s but the system is reporting spikes of more than 40,000 flows/s several times a day. Shouldn’t Exporters be reassigned to other Collectors once the threshold is reached?

A: The auto-replicate function uses 24-hour averages to determine whether Exporters need to be reassigned to different Collectors.

Q: How many Plixer Replicators installations does the auto-replication/load balancing functionality support?

A: One Plixer Replicator can be defined via the Plixer Scrutinizer web interface, but the system supports an unlimited number of Plixer Replicator appliances through manual configuration. For additional details, see the section on advanced configurations for Plixer Replicator or contact Plixer Technical Support.

Q: How many Plixer Replicator seed Profiles and/or unique listening ports does auto-replication/load balancing functionality support?

A: One seed Profile and one unique listening port are supported by each auto-replicate configuration. For additional details, see the section on advanced configurations for Plixer Replicator or contact Plixer Technical Support.

Q: Why does the scrut_util --autoreplicate command need to be run manually?

A: By default, the scrut_util --autoreplicate command is not scheduled to run automatically to allow users to run it only when necessary.

Q: Can Exporters be statically assigned to specified Collectors with auto-replication enabled?

A: To define static Exporters for a specific Collector, create a new Profile under Plixer Replicator as normal and configure the Exporters to send flows to the Collector.

Q: Is auto-balancing affected by Exporters that are configured to send flows directly to the Plixer Scrutinizer appliance?

A: When auto-replication is enabled, Exporters that do not send their flows through Plixer Replicator are considered Rogue Exporters. These Exporters will still count against the Collector’s Exporter count and flow limits.

Q: What happens if all Collectors in a distributed cluster have reached their collection rate thresholds and new Exporters are added to the configuration?

A: If there are no longer any Collectors with available bandwidth for load balancing, Plixer Replicator will stop assigning new Exporters but continue its auto-replication using the most recent viable configuration.

Q: Where does Plixer Scrutinizer log any auto-replicate changes that are made?

A: These changes can be found under /home/plixer/scrutinizer/files/logs/, inside a epoch-stamped file that contains a final output after the autoreplicate command completes.

Q: Does auto-replication take Missed Flow Sequence Numbers (MFSNs) when load balancing?

A: MFSNs are not taken into account when flows are assigned across a distributed Plixer Scrutinizer cluster for load balancing.

Q: Are old Profiles automatically removed after the configuration changes?

A: Older Profiles are not automatically removed, but it is safe to delete any Profiles that are no longer relevant to the current configuration file.