OS-Assisted Migration (OSAM) Fails When Source VM Has Disk Encryption Software

Products

• VMware HCX

Issue/Introduction

When attempting OS-assisted migrations (OSAM) with VMware HCX, migrations may fail during the quiesce or fixup phases if the source VM has disk encryption software (such as Vormetric) installed and enabled.

Common symptoms include

• Extended quiesce times that may exceed maintenance windows
• Failures during the VSS snapshot creation process
• Failures during the Windows fixup process
• Errors related to accessing directories or files during migration

Environment

• VMware HCX 4.x
• Windows or Linux source VMs
• Third-party disk encryption software installed on source VMs (e.g., Vormetric)
• OS-assisted migration (OSAM) workflow
• Non-vSphere source environments (such as Nutanix AHC, KVM, Hyper-V)

Cause

The presence of disk encryption software on source VMs can interfere with the OSAM process in several ways

1. Encrypted file systems are explicitly listed as unsupported for OSAM migrations in VMware documentation
2. The encryption software may prevent HCX from:
   • Creating and accessing required temporary directories
   • Taking consistent VSS snapshots
   • Performing necessary disk operations during migration
3. Access control mechanisms of encryption software can conflict with the temporary user accounts created by HCX during the migration process
4. Encryption software may be actively accessing file systems, which can significantly delay the OSAM switchover phase or prevent it entirely

Example Diagnostic Logs

When encryption software interferes with the migration process, you may see errors similar to these in your OSAM sentinel logs

ERROR Failed to open progress file: C:\temp\fixup\progress.txt.

Error: open C:\temp\fixup\progress.txt: The system cannot find the path specified.

WARN Fixup result file: C:\temp\fixup\result.json does not exist

WARN Verify failed for second stage fixup

INFO NIC mapping file: C:\temp\fixup\network-interface-map.json does not exist

ERROR Failed to perform fix-up operation on migrated VM. Failed to prepare for fixup.

INFO EVENT chanTeardownSuccess[DataWriterChan] : Successfully teared down channel

 

These logs typically indicate that the encryption software is preventing HCX from

• Creating necessary temporary directories
• Accessing required system files
• Completing the VSS snapshot process
• Performing required disk operations

Resolution

Since OSAM is required for migrations from non-vSphere environments, the only solution is to disable encryption during migration and re-enable it as needed after migration

Required Steps

• Temporarily disable the disk encryption software on the source VM before migration
• Perform the OSAM migration
• Re-enable and reconfigure encryption software on the destination VM after successful migration

Additional Information

Key Requirements

• Encrypted file systems are not supported for OSAM migrations
• Anti-virus software should be deactivated prior to migration
• For Windows systems: Only NTFS formatted volumes are supported (except ESP/EFI system partition with FAT32)
• For Linux systems: Supported file systems are ext2, ext3, ext4, XFS

Best Practices

• Always verify your backup strategy before modifying encryption settings
• Consult your encryption software vendor for proper procedures to disable/re-enable encryption
• Consider security implications and compliance requirements when temporarily disabling encryption
• Test the migration process on a non-production system first if possible
• Document current encryption settings before disabling for easier reconfiguration after migration

References

VMware HCX User Guide - Guest Operating System Considerations