General System Procedures - SYSCHECK - Data Inconsistency
- Last Updated: April 5, 2026
- 2 minute read
- Flowmon Products
- Flowmon Anomaly Detection System
- Documentation
Method description
This method controls the input data consistency and efficiency of the current Flowmon ADS application settings.
Method configuration
It is possible to configure the threshold ratio for each individual metric (for example, the number of unpaired flows) and turn on or off the detection of wrong active timeout settings on the flow exporter. Detection of duplicate packets in the monitored network can also be configured.
Method parameters
-
MinSingle: Amount of unpaired flows in the processed sample of traffic to show the warning (if 0, the control is not performed).
-
MinBroadcast: Amount of broadcast and multicast traffic in the processed sample to show the warning (if 0, the control is not performed).
-
MaxDecrease: Maximal value, which can decrease the current amount of transferred data relative to the minimum of the foregoing 4 hours (if 0, the control is not performed).
-
DetectTimeout: Activation of the control of the active timeout different than the standard 300 seconds (5-second tolerance).
-
Duplicates: Activation of the control of the duplicate packets in flows (it is recommended to turn this control off if the active sampling of the collector is enabled).
-
MaxNewEvents: The count of newly detected events generated by a single instance of the detection method in the last 5 minutes to raise the warning. If 0, the metric is not used.
-
MaxPerHour: The count of events generated by a single instance of the detection method in the last hour to raise the warning. If 0, the metric is not used.
-
DeactivateOnFlood: This parameter determines how many times the MaxNewEvents or MaxPerHour parameter has to be exceeded to deactivate the method instance. If 0, the instance will not be deactivated.
Interpretation of results
This method does not generate events like other methods but warnings are displayed in the status icon (bell) in the GUI. These warnings can be interpreted as specific problems with flow exporters (for example, wrong configuration or incomplete data).