This is an expected behavior. The new primary host begins monitoring all protected virtual machines to determine if they are still running, or if they need to be restarted. As the secondary nodes connect to the new primary host, they report the virtual machines that are running on the host. The new primary host removes these virtual machines from the list that it is still monitoring. Ten seconds after the new primary host is elected, it checks its list of monitored virtual machines and, if there are any, the primary host attempts to restart them. Because the fdm service was turned off on the host that was previously the primary host, it never becomes secondary node. This means that new primary host does not receive a report from that host with virtual machines running on it. As such, the new primary host attempts to fail over all protected virtual machines from the previous primary host.
Notes:
- If the fdm service is stopped on a secondary host, no new election for primary takes place and there is no new primary host. Therefore, the process of placing all the protected virtual machines in a list to monitor is not performed and there will be no attempt to fail over any virtual machines.
- If the fdm service is restarted, there will be an election. However, if there already is a primary node, the host connects as secondary node and there will be no attempt to fail over any virtual machines.
- Normally, services running in ESXi 5.0 are monitored by a watchdog. If, during normal operation, the fdm process halts, the watchdog restarts the process and a new election begins. If this happens on a primary node, the restart should complete quickly enough that no failover attempts occur.