Host goes in not-responding state due to ioFilterVP resource pool being out of memory

Products

• VMware vSphere ESXi

Issue/Introduction

Symptoms:

• The host goes into not-responding state in the vCenter inventory.
• The ioFilterVPServer is out of memory.
• Reboot fixes the issue temporarily.

Logs:

vmkernel.log

YYYY-MM-DDTHH:MM:SS cpu28:2099675)Admission failure in path: host/iofilters/iofiltervpd:ioFilterVPServer.2099675:uw.2099675
YYYY-MM-DDTHH:MM:SS cpu28:2099675)UserWorld 'ioFilterVPServer' with cmdline '/usr/lib/vmware/iofilter/bin/ioFilterVPServer'
YYYY-MM-DDTHH:MM:SS cpu28:2099675)uw.2099675 (4996) extraMin/extraFromParent: 512/512, iofiltervpd (599) childEmin/eMinLimit: 6382/6400
YYYY-MM-DDTHH:MM:SS cpu28:2099675)Admission failure in path: host/iofilters/iofiltervpd:ioFilterVPServer.2099675:uw.2099675
YYYY-MM-DDTHH:MM:SS cpu28:2099675)UserWorld 'ioFilterVPServer' with cmdline '/usr/lib/vmware/iofilter/bin/ioFilterVPServer'
YYYY-MM-DDTHH:MM:SS cpu28:2099675)uw.2099675 (4996) extraMin/extraFromParent: 256/256, iofiltervpd (599) childEmin/eMinLimit: 6382/6400

iofiltervpd.log

YYYY-MM-DDTHH:MM:SS iofiltervpd[2099675]: run:159:SSL Connection error 30 : SSL_ERROR_SSL error:2D071086:FIPS routines:FIPS_drbg_generate:selftest failederror:140B512D:SSL routines:ssl_get_new_session:ssl session id callback failed

Environment

VMware vSphere ESXi 7.0.x
VMware vSphere ESXi 8.0.x

Cause

There is a memory leak in the gsoap/openssl library when SSL caching is enabled. IOFilterVP SSL cache consumes heap memory for each SSL session (for each VASA API request). Eventually, it consumes all the memory from the iofiltervp resource pool.

These error messages are found that the host is encountering an issue with an I/O filter in a server environment.

This seems to involve a problem with accessing or processing a virtual device filter or an I/O filter driver.

 

Resolution

This issue will be fixed in the below versions:

• vSphere ESXi 7.0.3 P09
• vSphere ESXi 8.0 P03

Workaround:
As a workaround, restart the IOFilterVP service.

1. SSH into the affected ESXi host
2. Restart the IOFilter service:

/etc/init.d/iofiltervpd restart

 

 

Additional checks to be performed:

 

Ensure that the I/O path to the storage or virtual device is accessible and correctly configured.

Verify that no disk or virtual device has become unresponsive or disconnected.

The error mentions an "Admission failure," which could point to resource allocation issues such as CPU, memory, or storage resources being insufficient for processing the I/O filter requests.

You may need to check resource utilization (esxtop) to confirm if there are any resource contention issues.

 

Restart the I/O Filter Service

If the issue is related to a service (such as ioFilterVPServer), you may want to try restarting the service responsible for managing the I/O filters.

This might resolve temporary connectivity or resource allocation problems.

Please go through the steps to perform the same

/etc/init.d/iofiltervpd status

/etc/init.d/iofiltervpd restart

/etc/init.d/hostd restart

 

You can also take a maintenance window and restart all the services with the command: services.sh restart