Red Hat OpenShift Container Platform

Using the eBPF agent alert

Resolve the NetObservAgentFlowsDropped alert, which occurs when the eBPF agent hashmap is full, by increasing the spec.agent.ebpf.cacheMaxFlows value in the FlowCollector custom resource.

An alert, NetObservAgentFlowsDropped, is also triggered when the capacity limiter is triggered. If you see this alert, consider increasing the cacheMaxFlows in the FlowCollector, as shown in the following example.

Increasing the cacheMaxFlows might increase the memory usage of the eBPF agent.

Procedure

In the web console, navigate to Ecosystem → Installed Operators.
Under the Provided APIs heading for the Network Observability Operator, select Flow Collector.
Select cluster, and then select the YAML tab.
Increase the spec.agent.ebpf.cacheMaxFlows value, as shown in the following YAML sample:
```
apiVersion: flows.netobserv.io/v1beta2
kind: FlowCollector
metadata:
  name: cluster
spec:
  namespace: netobserv
  deploymentModel: Service
  agent:
    type: eBPF
    ebpf:
      cacheMaxFlows: 200000
```
where:

spec.agent.ebpf.cacheMaxFlows

Specifies the maximum number of flows to cache. If a NetObservAgentFlowsDropped alert occurs, increase this value from its current level.