Traffic Dropped - IDPS Engine Network Oversubscription Alarm

Products

• VMware NSX

Issue/Introduction

Title: Alarm for Traffic Dropped - IDPS Engine Network Oversubscription
Event ID: distributed_ids_ips.idps_engine_dropped_traffic_network_oversubscribed

Alarm Description

• Purpose:The IDPS engine is unable to keep pace with the rate of incoming traffic resulting in the excess traffic being dropped. For more details, login to the ESX host and issue the following command: `vsipioctl getdpiinfo -s` and look at oversubscription stats.
• Impact: Traffic is being dropped by the IDPS engine on ESX Host.

Environment

VMware NSX

Resolution

Steps to Resolve

For 4.0.0 and higher

 

Recommendations:

 

Review the reason for oversubscription. Review the IDPS rules to minimize the traffic that is handled by the IDPS service.