**Environment** - Cloudera CFM 2.1.7 / Apache NiFi 1.26.0 - Cloudera CDP 7.3.1 - Flow source: Cisco ASA Firewall (IPFIX export)   **Issue**   The `ListenNetFlow` processor successfully decodes standard IPFIX/NetFlow v9 fields but produces a WARN for every packet that contains Cisco ASA enterprise fields:   ``` WARN com.cloudera.nifi.netflow.ListenNetFlow: Sender [/x.x.x.x] Field Type [33002] Length [2] Field Decoder not found WARN com.cloudera.nifi.netflow.ListenNetFlow: Sender [/x.x.x.x] Field Type [33001] Length [12] Field Decoder not found WARN com.cloudera.nifi.netflow.ListenNetFlow: Sender [/x.x.x.x] Field Type [33000] Length [12] Field Decoder not found WARN com.cloudera.nifi.netflow.ListenNetFlow: Sender [/x.x.x.x] Field Type [40000] Length [12] Field Decoder not found   ```   At production NetFlow volume, this generates thousands of WARN lines per second, making `nifi-app.log` effectively unusable for monitoring other issues.   More critically, the data in these fields is silently dropped:   | Field ID | Cisco Name | Description | |---|---|---| | 33000 | INGRESS_ACL_ID | ACL that matched the flow on ingress | | 33001 | EGRESS_ACL_ID | ACL that matched the flow on egress | | 33002 | FW_EVENT | Firewall event type (allow / deny / teardown) |   These are Cisco Private Enterprise Number (PEN 9) fields. They are documented in Cisco's IPFIX implementation guide and are present in every flow exported by Cisco ASA firewalls. For security operations use cases, `FW_EVENT` (33002) in particular is essential — it identifies whether a connection was permitted or denied.   **Expected behavior**   `ListenNetFlow` should support registering enterprise IPFIX field decoders via configuration (PEN + field ID mapping), so operators can define custom fields without modifying processor source code. As a baseline, well-known Cisco PEN 9 fields (33000, 33001, 33002) should be included in the default field registry. Unknown enterprise fields should be logged at DEBUG, not WARN, since encountering undefined vendor fields is expected behavior in production IPFIX environments.   **Impact**   - Log files roll too fast to monitor other issues - ACL and firewall event data is lost from every flow record - Security teams lose visibility into deny/allow decisions at the firewall level     Happy to provide packet captures or field mapping documentation if useful. ... View more

Hello everyone, I have developed an Apache NiFi flow that ingests streaming data, converts it to JSON, merges the records, and then stores them in HDFS. However, I have observed a couple of issues: File Structure: After the merge operation, many files retain their original structure rather than being merged as expected. Performance: Increasing the number of pins along with the minimum and maximum record counts and bin sizes causes the merge process to become significantly slower. Conversely, reducing these parameters results in files that mostly maintain their original structure. Could anyone provide insights or recommendations on how to resolve these issues? Thank you. My crrunt cnfigration that cause the flow to go the orginal current comigration where it causes go to original    The flow the flow    The congigration that never showsnmerged records. with this cofigration will take forever to merge I didn't see any output   ... View more

  Hello, We are forwarding NetFlow v9 data from a core switch and VPN to NiFi. In NiFi, we are using the NetFlow Listener processor to listen to the NetFlow traffic. However, the processor is unable to process the data, and the only information we could find in the logs after enabling debug logging is the following: 2025-03-06 16:25:29,502 WARN com.cloudera.nifi.netflow.ListenNetFlow: ListenNetFlow[id=861330c9-6ffc-1e81-9978-be1bba4f3524] Sender [/0.0.0.0:00000] Cached Template ID [259] not found 2025-03-06 16:25:29,502 DEBUG com.cloudera.nifi.netflow.ListenNetFlow: ListenNetFlow[id=861330c9-6ffc-1e81-9978-be1bba4f3524] Sender [//0.0.0.0:00000] Version [9] FlowSet ID [259] Length [604]   Is there anyone faced such issue and help us to identify the cause of this issue and suggest possible solutions? Thank you for your help.     ... View more