There might be inconsistencies in the number of VMs, physical servers, groups, or flows that are shown in the Groups or Computes view if you leave the Security Intelligence visualization UI page displayed for a long time.

Problem

If you open the Groups view or Computes view, and you leave the Security Intelligence visualization UI page open for a long time, new events are incrementally reported and merged into the view. There might be some inconsistencies in terms of the Group, VM, or physical server counts during the incremental reporting and merging. For example, if there are some configuration changes, such as changes in group VM membership that were triggered during the incremental reporting time, then you might observe inconsistencies in the visualizations being displayed. Any new flows generated from the newly added compute entities might not be included in the current view either.

You might observe the following inconsistencies in the visualizations being displayed.
  1. An Uncategorized group node shows an incorrect VM count.
    • The VM count displayed for an Uncategorized group is different from and is usually larger than the VM count shown when a new Groups view is displayed.
    • The VM count displayed for an Uncategorized group is different from and is usually larger than the VM count returned when you right-click a group's node and select VM.
  2. An Uncategorized group in a deep dive Groups view shows an inconsistent number of VMs.
    • The Uncategorized group shown in a deep-dive Groups view might show more VMs than what is shown in a newly opened deep-dive Groups view.
    • The Uncategorized group in a deep dive Groups view might show more VMs than what is listed when you right-click the Uncategorized group's node and select VM.
    • A VM might get a live update in the Uncategorized group, even after it might have already been added to another group.
  3. An unnamed VM might be shown on the Groups and Computes views.
    • This problem is commonly seen on VM members that belong to the Unknown or Uncategorized group. There is also a small possibility that it appears in a normal group.
  4. When the Security Intelligence application is ingesting traffic flows at a high velocity rate when the Groups or Computes view is displayed, the incremental visualization updates to the view might get delayed.

Cause

The real-time data reporting currently has some known inconsistencies that occur during incremental reporting.

Solution

To clear up any inconsistencies, reload the entire Security Intelligence visualization canvas by refreshing your web browser.