Inconsistent/Non-existent historical data

[dpkano]

Environment:

• OS name: Debian GNU/Linux (Raspberry PI OS)
• OS version: 12 (bookworm)
• Architecture: aarch64 (Raspberry Pi 4 Model B Rev 1.5)
• ntopng version/revision: 6.3.240929 [Enterprise/Professional build]
• ntopng edition: Professional Embedded
• nprobe version/revision: 10.7.240928
• nprobe edition: nProbe Embedded

ntopng.conf:

-G=/var/run/ntopng.pid
-i=tcp://127.0.0.1:5556
--local-networks=10.0.0.0/8

nprobe.conf

-i=none
-n=none
-3=2055
-T="@NTOPNG@"
--ntopng=zmq://127.0.0.1:5556

Setup (https://www.ntop.org/ntopng/how-to-analyse-mikrotik-traffic-using-ntopng/):

What happened:
The historical data for hosts rarely displays data. For most of my hosts, when I click the chart icon in the hosts page, nothing is displayed. For a very few hosts (e.g. my local DNS server), it shows inconsistent data like the chart below:

How did you reproduce it?

• Go to: [ntopng host]:3000/lua/host_details.lua?host=[any host]
• Click the historical data icon:
  
• This is what's displayed for the majority of my hosts:
  

Debug Information:

"systemctl status ntopng"

[dpkano]

Extra info: I've disabled nprobe and started sending mirrored traffic to ntopng's interface. Nothing changed in the historical data. I still can't see anything. There are no errors in the ntopng logs. Are there any tips where I can start debugging this?

[MatteoBiscosi]

Hi @dpkano could you please send a screenshot of an host details that has that issue?

[dpkano]

Yep, here it they are:

The MAC one:

And the empty historical chart:

[MatteoBiscosi]

Hi, probably the reason is because you did not enable the One Way Traffic Timeseries option from the settings (see below).
By default is disabled because in case of ddos attacks or scans it could lead to a huge amount of timeseries created and possibly to full the disk of the machine, so keep in mind this point. In case you are not intersted in this possibility just simpli enable the preference just like in the screenshot.

[dpkano]

yes. This seems to be the case. Now I can see traffic for many (if not all) of the hosts that had never displayed traffic before. But why? It's not clear from that screen that enabling it would allow traffic to be recorded for all hosts.

Thanks!