fltmc output shows different values for the Num Instances column with vsepflt on different VMs

Products

• VMware NSX

Issue/Introduction

Symptoms:
When running the fltmc command on a VM with the NSX File Introspection driver (vsepflt.sys) installed, the value of Num Instances is different on VMs.

Environment

VMware NSX for vSphere 6.4.x
VMware NSX for vSphere 6.3.x
VMware NSX for vSphere 6.2.x

Resolution

There will be an instance of vsepflt for each volume that it is monitoring.

The list of all volumes the windows filter manager sees can be show by running the "fltmc volumes" command at an administrator command prompt.

Running fltmc instances | find "vsepflt" will list each instance of the vsepflt thin driver and which volume it is associated with.

The number shown in the altitude column represents the order where filters are processed in the stack. There are specific altitude ranges to allow drivers that need to run before others are guaranteed to be processed in the correct order. The allocation of altitudes to minifilter drivers is managed by Microsoft.