NSX alarm: The objects defined in the system for Network Introspection Service Paths has exceeded count

Products

• VMware vDefend Firewall

Issue/Introduction

The NSX alarm page is showing the following alarm: The number of objects defined in the system for Introspection Service Paths has reached xxx which is above the maximum supported count of 512.

 

There might or might not be impact for the environment. 

Environment

VMware NSX 

vDefend Firewall

It affects any version 

Cause

Customer is using Network Introspection in the NSX environment where it is deployed using the cluster methodology. i.e. where all the SVMs (Service VMs) are deployed in a single cluster.

The error is generated when the SVMs are vMotioned too frequently. Each time a SVM is vMotioned, a new Service path is created for that SVM. The old path will be automatically cleaned up after 24 hours. The limit can be hit if there are a high number of vMotions which can be caused by an overloaded cluster or DRS being set too sensitive.

This can be verified by checking the number of vMotions for the SVMs for the previous 24 hours.

 

Resolution

This is expected behavior, if a high number of vMotions is occurring. 

To resolve the issue you need to reduce vMotions, which can be done by:

1. Disabling DRS for the SVM cluster.
2. Reducing sensitivity for DRS in the SVM cluster