syslog server received lots of the message with FILE_INTEGRITY_CHECK_FAILED related SRM server.

Products

• VMware Live Recovery

Issue/Introduction

After setting syslog in SRM appliance, lots of the message with "FILE_INTEGRITY_CHECK_FAILED" in syslog server

log messages will be similar to this:
WARNING fileintegrity [FILE_INTEGRITY_CHECK_FAILED] Reason : REGULAR FILE MODIFIED, Name : "/etc/rsyslog.d/srm.conf" 
ERROR     fileintegrity [FILE_INTEGRITY_CHECK] Overall status : FAILED. RESULTS: TOTAL: 22755 VERIFIED: 22755 [ADDED: 0 DELETED: 0 MODIFIED: 1]

Cause

This is because baseline information is changed due to setting syslog configuration.

Resolution

To workaround of this issue, recreate baseline information.

1. SSH as admin user to the Site Recovery Appliance
2. switch to root user via su command
3. run following command.

 /opt/vmware/fileintegrity/integrity_checker.py -f baseline

4. run following command and confirm to stop logging on syslog server.

 /opt/vmware/fileintegrity/integrity_checker.py -f check