Intermittent Last Sync Status "failed" in NSX Manager / Domains / Event Log Servers

Products

• VMware NSX Networking

Issue/Introduction

Symptoms:

• "Last sync status" will be showing as "Failed" and sometimes as "Success" 
  

• "Last sync date" can be from a long time ago 

• Configuring WMI won't solve the issue
  

• In NSX manager logs (vsm.log), you may see entries similar to:

r: 305849756	Event ID: 4624	Type: 8	Generate at: Mon Oct 22 11:47:06 CEST 2018	Details:[S-1-0-0, -, -, 0x0, S-1-5-21-530208284-1578177633-111032338-231675, ITS33408$, GAVLE, 0x32528c28, 3, Kerberos, Kerberos, -, {076275EF-F075-87BD-34D9-230B8F3D01A3}, -, -, 0, 0x0, -, 192.168.10.154, 50859, %%1833], reached its componenet queue threshold: 1000, user event could be lost.

and 

2018-10-22 16:24:06.973 CEST  WARN taskScheduler-22 WinEventLogCIFSReader:328 - - [nsxv@6876 comp="nsx-manager" subcomp="manager"] gkdc1: Error happened when reading event log, will close connection. Error message: The data area passed to a system call is too small.

Cause

You see this behavior when you have more than 200 login/min. Currently, IDFW supports 200 login/min in both CIFS and WMI.

Resolution

Currently there is no resolution.

Workaround:

There is no workaround provided apart from reducing the number of events from event log servers. One alternative for virtual machines is to use Guest Introspection, by doing that there is no need to log scrape to catch the logins.

Additional Information

Impact/Risks:

User events could be lost.