Malware Prevention does not raise an alarm when there is low on disk space on NSX-T Edge Node or SVM

Products

• VMware NSX

Issue/Introduction

Symptoms:

• When you run the command df -h as root user on the NSX-T Edge Node you may see one or more disks at 100% percent utilization.
• You may see similar entries in the /var/log/syslog.log on the NSX-T Edge Node Or Security Virtual Machine (SVM)

"analyst_sdk.pipeline.serializing.DiskWriter - ERROR - Serializing...failed: [Errno 28] No space left on device"

• You notice that Malware Prevention may have become unstable on the affected NSX-T Edge Node or SVM.
• No alarms are received in the NSX-T UI when the NSX-T Edge Node or SVM have low disk space.

Environment

VMware NSX-T Data Center 4.x
VMware NSX-T Data Center

Cause

The Malware prevention becomes unstable due to the lack of space on the NSX-T Edge Node or SVM.

Resolution

This is a known issue impacting NSX-T Data Center.

Workaround:
If this issue appears on an SVM Node, vMotion some VMs away from the host to reduce the load on the SVM.
If the NSX-T Edge Node is affected please open a service request with VMware GSS, referencing this KB number.

Additional Information

The malware prevention components run on NSX-T Edge nodes (when North-South malware prevention is enabled) and on SVMs on Host nodes (when East-West malware prevention is enabled).