The VMware Directory Service (VMDIRD) is entering an unrecoverable state due to a mismatch in CEIP settings during the vCenter Server deployment.

Products

• VMware vCenter Server

Issue/Introduction

• VMDIRD enters an unrecoverable state after deploying a new vCenter Server with an embedded PSC, or a new external PSC, pointing to an existing vSphere domain configured in Enhanced Linked Mode (ELM).
• The VMDIRD logs contain entries similar to the following:
  
  • For Windows log location : %PROGRAMDATA%\VMware\vCenterServer\logs\vmdird\vmdir.log
  • For vCenter Server Appliance : /var/log/vmware/vmdird/vmdird-syslog.log

YYYY-MM-DDTHH:MM:SS.790173+00:00 warning vmdird t@140488925480704: ReplDeleteEntry/VmDirInternalDeleteEntry: 66 (Operation not allowed on non-leaf). DN: cn=ConsentConfigContainer,cn=PhoneHome,cn=Services,dc=vsphere,dc=local, first attribute: cn, it's meta data: '59961:2:a1c1ae76-####-####-####-########594:20190724200208.654:55550'. NOT resolving this possible replication CONFLICT. For this object, system may not converge. Partner USN 0
YYYY-MM-DDTHH:MM:SS.094808+00:00 warning vmdird t@140488925480704: ReplDeleteEntry/VmDirInternalDeleteEntry: 66 (Operation not allowed on non-leaf). DN: cn=ConsentConfigContainer,cn=PhoneHome,cn=Services,dc=vsphere,dc=local, first attribute: cn, it's meta data: '60105:2:a1c1ae76-####-####-####-########594:20190724200208.654:55550'. NOT resolving this possible replication CONFLICT. For this object, system may not converge. Partner USN 0
YYYY-MM-DDTHH:MM:SS.912616+00:00 warning vmdird t@140488925480704: ReplDeleteEntry/VmDirInternalDeleteEntry: 66 (Operation not allowed on non-leaf). DN: cn=ConsentConfigContainer,cn=PhoneHome,cn=Services,dc=vsphere,dc=local, first attribute: cn, it's meta data: '61248:2:a1c1ae76-####-####-####-########594:20190724200208.654:55550'. NOT resolving this possible replication CONFLICT. For this object, system may not converge. Partner USN 0
YYYY-MM-DDTHH:MM:SS.605939+00:00 warning vmdird t@140488925480704: ReplDeleteEntry/VmDirInternalDeleteEntry: 66 (Operation not allowed on non-leaf). DN: cn=ConsentConfigContainer,cn=PhoneHome,cn=Services,dc=vsphere,dc=local, first attribute: cn, it's meta data: '65002:2:86bd65ad-2897-####-####-####-########c2a:20190724153438.014:55372'. NOT resolving this possible replication CONFLICT. For this object, system may not converge. Partner USN 0

Environment

VMware vCenter Server Appliance 6.7.x

Cause

The issue stems from replication conflicts related to CEIP entries in the VMDIRD database.

Resolution

This issue is resolved in vCenter Server 6.7 Update 3b, available at Support Documents and Downloads (broadcom.com).

To workaround this issue:

• Check the CEIP setting of the vCenter Server where new vCenter Server deployment is trying to point to in enhanced linked mode (replication partner)
• Redeploy the PSC/VCSA with the current CEIP state of existing vCenter Server
• Follow below steps to get the CEIP information of existing vCenter server:
  • Login to vCenter webclient as SSO administrator or with an account with Global Permissions
  • Navigate to Home -> Administration -> Customer Experience Improvement Program
    OR
  • SSH to vCenter Server Appliance/ PSC and run below command
    • /usr/lib/vmware-cis-license/bin/ceip-cli.py get-ceip