When using multiple vCenter Server Appliances (VCSA) in the same Single Sign-on Domain, replicating in Enhanced Linked Mode (ELM), there is high potential of corruption of the domain if snapshots of the appliances are taken while they are in running state. Use of offline snapshots in ELM deployments is very strongly recommended for a safe rollback point. This means all appliances should be gracefully shut down, and snapshots need to be taken while the VCSAs are in powered off state (at the same time).
If any change must be reverted, restore all of the nodes in the ELM deployment to this offline/consistent snapshot state. Only start powering the restored nodes back on after all of them have been restored from the snapshots.
Doing otherwise can and will introduce inconsistencies between the local VM Directory instances of the embedded platform service controllers, which will prevent the nodes from successfully replicating with each other.
Notes:
vCenter Servers using ELM replicate their vmdir database changes to one another every 30 seconds.
If snapshots of vCenter Servers are created without them being powered down they will be an in uncertain replication state even when queisced.
Also, when reverting just one vCenter Server from snapshot and not others they may restore with different synchronization states, which can cause much additional work to manually synchronize the vmdir database. And sometimes this can even cause problems with the vmdir database that cannot be repaired
As stated above, VMware recommends to have offline Snapshots (virtual machine powered off) of all nodes in the same SSO domain, aka running in ELM replication, before any activity that will include changes in the vCenter Server.
Offline snapshots of all nodes in an SSO domain (ELM) are required when any SSO domain update will be performed. This includes but is not limited to:
lsdoctor
tool to make any changes.
Any read only activity does not require offline snapshot. That means the below activities can be performed with NO need for snapshot (Neither online nor offline).
lsdoctor
tool with the --
lscheck
parameter.checksts
script.Caution:
lsdoctor
tool unless using the --lscheck
switch (only) which is used to check for common issues in the lookup service.lsdoctor
tool, see Using the 'lsdoctor' Tool.checksts
script, see Checking Expiration of STS Certificate on vCenter Servers.