Open alarm for Long-Running Packet Capture on an Edge in NSX

Products

• VMware NSX

Issue/Introduction

• The Edge node notifies an alarm about the Long-Running Packet Capture sessions.

  

• Log in to the Edge node as the admin user and run the command get capture session to verify a session is active.
• In the example below, we see an active session for ID 0 and fp-eth1:

  <Edge-hostname>> get capture session
  <timestamp>
  Packet Capture Session
  ID                   : 0
  PORTS                : ['fp-eth1']
  
  Packet Capture Session
  ID                   : 1
  PORTS                : []
  
  Packet Capture Session
  ID                   : 2
  PORTS                : []
  
  Packet Capture Session
  ID                   : 3
  PORTS                : []
  
  Packet Capture Session
  ID                   : 4
  PORTS                : []
  
  Packet Capture Session
  ID                   : 5
  PORTS                : []

Note: The preceding log excerpts are only examples. Date, time, and environmental variables may vary depending on your environment.

Environment

VMware NSX

Cause

• The purpose of this alarm is to notify users when a packet capture on specific interface on the edge device has been running for more than 30 minutes
• This alarm prompts attention to potential prolonged capture sessions that gradually affects the performance of the Edge nodes.

 

Resolution

For 4.2.0 and higher:

• This alarm is resolved upon termination of the extended packet capture session on the specified interface.
• Log in to the Edge node as the admin user.
• To delete or cancel the packet capture session, run the command del capture session <ID> interface <edge-interface-uuid>.
• There is no maintenance window required for the Edge to run the above command.

Additional Information

Impact:
1. Packet captures can consume significant system resources, including CPU, memory, and disk space. Prolonged captures may lead to increased resource utilization, potentially impacting the overall performance of the edge device.
2. Packet captures generate large amounts of data, and storing this data can lead to increased storage usage. If not managed properly, it may exhaust available disk space, affecting other critical system functions.
3. Continuous packet captures generate network traffic, especially if capturing all packets on a busy network interface. This additional network overhead can impact the overall network performance.
4. Depending on the edge device's capabilities, a long-running packet capture might compete with other essential functions. This could impact the device's ability to process network traffic, execute other tasks, or provide services.