Repeated "SequencerRun() ERROR" message in log about nfdump HOT 4 CLOSED

This error means, that the expected input length of the data does not match, what the template announces. The sequencer is the programmable data processor which moves input data to the output stream.
The traffic speed should not be the reason for that.
How often do you see this message? Rarely or did you get flooded by those?
Do the flow records looks correct, which are stored otherwise?
Have you tried to evaluate, if it’s a specific source - just one or several of those 30 sources?

from nfdump.

How often do you see this message? Rarely or did you get flooded by those?

Often, several messages per second

Do the flow records looks correct, which are stored otherwise?

Can't check all archive, and error appeared just recently, but if i find something, i'll let know.

Have you tried to evaluate, if it’s a specific source - just one or several of those 30 sources?

It's good question. After limiting by firewall netflow packets only from "known good" sources (same location) error is gone (just half a day passed, but...). Now i'm inspecting remaining (remote) sources.

from nfdump.

During the check, I discovered a router with an incorrectly configured NAT along the route of netflow packets. After correcting the NAT configuration, the nfcapd errors also gone (it looks like the packets were somehow damaged or modified). So, i think this issue are resolved.

It will be helpful, if log message will contain ip address of associated source, diagnostics and debug will be faster and easier.

from nfdump.

You are certainly right. I will improve the diagnostics. Many thanks for the input.

from nfdump.