firewall_draft_config_change table size keeps increasing

Products

• VMware NSX

Issue/Introduction

NOTE: If the table has too many entries then the preserved auto-drafts should not be deleted (via UI or REST API) as this can cause manager to go out-of-memory while deleting old draft_configs, especially on a manager that with small memory footprint. 

Symptoms:

 

1. Any of the firewall auto-draft configuration is changed to ‘preserve=yes’
2. "/common" utilization goes beyond 70% and above.
3. FTP backup/DB backup file size grows abnormally with high number of firewall rules.
4. Size of “firewall_draft_config_change” table goes above normal limit, old entries from “firewall_draft_config_change” table doesn’t get auto purged.

All of the above symptoms needs to match.

Cause

Compaction task purges the old draft_config_changes whenever they exceed (this will be done in range), this compaction will be done automatically for auto-drafts.

When user enables “preserve=yes” for any auto-drafts from UI,  the compaction task checks for range of entries that needs to be deleted and it will not go ahead as one of the entry is having preserved=true.

As a result, compaction task gets stuck.

It is recommended to not enable preserve=yes option for any auto-save draft as it can cause issue with compaction task.

Resolution

This issue is resolved in VMware NSX Data Center for vSphere 6.4.7, available at VMware Downloads.

Additional Information

1. It is recommended to not enable preserve=yes option for any auto-save draft as it can cause issue with compaction task.
2. Maximum total drafts are supported by NSXv is 100 which includes 90 auto-drafts + 10 manual saved drafts.