Troubleshooting Tip: Sflow not working on FortiSwitch

[magarwal]

Description	This article describes a step-by-step procedure to troubleshoot sflow issues on a Managed FortiSwitch.
Scope	FortiGate, FortiSwitch.
Solution	Verify that the configuration is valid, as per the documentation. Verify that there is connectivity to the collector and the collector IP is pingable from the FortiGate and FortiSwitch. execute ping <IP> Ensure that the sflow traffic is not blocked by any firewall rule. If the configuration is correct, use the following sniffer on the FortiSwitch CLI to see if any packets are seen. diagnose sniffer packet any "host 10.98.254.131 and port 9996" 4 0 a    (Note: Here, port 9996 is the flow port set on the switch.) If no packets are seen, verify if the flow process is running on the switch using the following command:  diagnose sys top If the flow process is not seen running on the switch, check the flow process ID and kill the process on the switch. To check the process ID:   fnsysctl ps (Something like '2198 0 129m S N /bin/sflowd' should be seen. Here, the process ID is 2198.) To kill the process: fnsysctl kill -11 2198 After doing so, verify the 'sflowd' process is running: diagnose sys top If the process is running and yet no sflow data is seen on the collector, it is because of an incorrect collector IP or port set on the switch. Make sure that the collector IP set is correct. If the issue still persists, open a TAC case and and supply the following logs from the switch: diag debug application sflowd -1 sh full diag debug report diag debug application sflowd -1 diag debug enable Once the logs are captured, disable logging: diag debug disable