vMotion fails due to no namespaces present in the .db file

Products

• VMware vDefend Firewall with Advanced Threat Prevention
• VMware vSphere ESXi

Issue/Introduction

• The VM is protected by the Guest Introspection (GI) endpoint protection and <vmname>.db file exists in the same directory as the .vmx file.
• vMotion failure and you see the errors similar to:
  
  The source detected that the destination failed to resume. An error occurred restoring the virtual machine state during migration. Failed to receive migration.
  
  
• In the vmware.log file, there is the following entry similar to:
•  
• 2023-03-10T03:52:02.854Z In(05) vmx - NamespaceMgrCheckpoint: opening database connection (vmname.db).
2023-03-10T03:52:02.856Z In(05) vmx - NamespaceMgrCheckpoint: No valid queue found while restoring the namespace events. The migrate type is 1.

Cause

During a vMotion operation, the VMX NamespaceMgr checkpointing mechanism expects namespaces entry in the .db file if namespaces are configured for the VM. In such cases, if the entry is not present in the .db file, the vmotion will fail. This is because the namespaces table in the .db file is empty, and/or mismatched with the VMX's in-memory state.

Resolution

This issue is resolved in VMware ESXi 7.0 Update 3q and 8.0 Update 3e.

Workaround:

You can perform either of the following two workarounds.

Option 1: Delete the .db file

1. 1. Power off the VM.
   2. Delete the <vmname>.db file.
   3. Power on the VM.
   4. Migrate the VM.

Option 2: Regenerate the .db file online

1. 1. Create the same namespaces (empty) as in the VMX's in-memory in the VM’s db file on the source host.
      1. Download workaround.py and upload it to the datastore.
      2. Login to source ESXi shell as root.
      3. Execute the python script:
         
         
      4. python workaround.py {-n <name> | -i <vmid> | -p <vmx-path>}
         
         
      5. Example:
         
         python workaround.py -n vmname
         
         
   2. Publish the EPP policies from the NSX to the VM which will update the namespaces in the db file. Execute following steps/tutorial for creating/publishing such endpoint policy protection.
      
      
      1. Identify the VM which failed to migrate from vCenter console and note down its name.
      2. Login to NSX as admin user.
      3. Go to [Security] tab and select [Endpoint Protection Rules] in menu item on left panel.
         
         
         
         
      4. Identify the rule applied to this VM in [Rules] grid.
      5. Create a new group with this VM as the member as shown below.
         1. Identify the original group to which the affected VM belongs.
            
            
            
            
         2. Create a new group with the affected VM as member.
            
            
            
            
            
            
            
            
      6. Create a duplicate policy and rule, applying the same service profile as existing.
         
         
         
         
      7. [Publish] the rule and wait for success state.
      8. Try vMotion on the affected VM.
      9. Move the VM to original group and delete the newly created duplicate group.