Edge long running packet capture Alarm

Products

• VMware NSX

Issue/Introduction

• Edge node notifies an alarm about the Long-Running Packet Capture sessions

• Login to the Edge node as user admin and running the command get capture session | find ID|PORTS
• The PORTS lists the UUID's of the Edge Interface on which the packet capture is captured on

Environment

VMware NSX

Cause

• The purpose of this alarm is to notify users when a packet capture on specific interface on the edge device has been running for more than 30 minutes
• This alarm prompts attention to potential prolonged capture sessions that gradually affects the performance of the Edge nodes.

 

Resolution

For 4.2.0 and higher

• This alarm is resolved upon termination of the extended packet capture session on the specified interface.
• Login to the Edge node as user admin
• To delete/cancel the packet capture session, run the command del capture session <ID> interface <edge-interface-uuid>
• There is no maintenance window required for the Edge to run the above command.

Additional Information

Impact:
1. Packet captures can consume significant system resources, including CPU, memory, and disk space. Prolonged captures may lead to increased resource utilization, potentially impacting the overall performance of the edge device.
2. Packet captures generate large amounts of data, and storing this data can lead to increased storage usage. If not managed properly, it may exhaust available disk space, affecting other critical system functions.
3. Continuous packet captures generate network traffic, especially if capturing all packets on a busy network interface. This additional network overhead can impact the overall network performance.
4. Depending on the edge device's capabilities, a long-running packet capture might compete with other essential functions. This could impact the device's ability to process network traffic, execute other tasks, or provide services.