NSX Alarm: Application on NSX node ..... has crashed. The number of core files found is 1.

Products

• VMware NSX
• VMware NSX Firewall

Issue/Introduction

The alarm below is seen within the NSX UI:

When looking at the core dump within the ESXi host the identifier of cfgagent is seen:

/var/core/nsx-cfgagent-zdump.xxx

Environment

VMware NSX 4.1.2.5

Cause

Configuration settings on DFW containers with:

• A high number of IP addresses within address sets
• Specific containers show large amounts of IP churns occurring (for example: churning average is seen to be 20 times per second or more)

The ESXi host reports a higher amount of memory utilization when the command nsxcli -c get firewall thresholds (for example: the host is reporting 50% or more memory utilization).

 

Resolution

There are a few ways to resolve this issue:

Note: Impact of the initial crash should be minimal as the cfgagent process will be immediately restarted by watchdog

• Reduce the amount of IP churns for the container
• If possible, convert dynamic groups to static groups
• Clean up the zdump files to clear the alarm (refer to Application on NSX node has crashed alarm for this process)