VMkernel Warning Log Flooded with IPFIXPC Translate Messages

Products

• VMware vSphere ESXi

Issue/Introduction

/var/run/log/vmkwarning.log in ESXi host is flooded with below messages:

YYYY-MM-DDThh:mm:ss.860Z cpu48:42474696)WARNING: Ipfix: IpfixPCTranslate:137: get port non-excl failed: 0x4001c20: Not found
YYYY-MM-DDThh:mm:ss.860Z cpu48:42474696)WARNING: Ipfix: IpfixPCTranslate:137: get port non-excl failed: 0x4001c20: Not found
YYYY-MM-DDThh:mm:ss.860Z cpu48:42474696)WARNING: Ipfix: IpfixPCTranslate:137: get port non-excl failed: 0x4001c20: Not found
YYYY-MM-DDThh:mm:ss.860Z cpu48:42474696)WARNING: Ipfix: IpfixPCTranslate:137: get port non-excl failed: 0x4001c20: Not found
YYYY-MM-DDThh:mm:ss.860Z cpu48:42474696)WARNING: Ipfix: IpfixPCTranslate:137: get port non-excl failed: 0x4001c20: Not found
YYYY-MM-DDThh:mm:ss.860Z cpu48:42474696)WARNING: Ipfix: IpfixPCTranslate:137: get port non-excl failed: 0x4001c20: Not found

Environment

VMware ESXi 7.x
VMware ESXi 8.x

Cause

The warning is generated because a cached NetFlow record was created when the port was enabled. However, by the time the flow times out and an export is triggered, the port has already been disabled. This mismatch during the port lookup results in the log message. If the port is frequently enabled and disabled, such warnings are expected and can be ignored.

Resolution

The warnings can be ignored for now, and there is no workaround available.