syslog server received lots of the message with FILE_INTEGRITY_CHECK_FAILED related to vCenter server

Products

• VMware vCenter Server

Issue/Introduction

The warning [FILE_INTEGRITY_CHECK_FAILED] was observed in the syslog server which was originating from the vCenter Appliance (vc-civ6-01)

backup.*
...
YYYY-MM-DDTHH:MM:SS [integrity_checker::log_and_print:integrity_checker.py:76] WARNING: [FILE_INTEGRITY_CHECK_FAILED] Reason : REGULAR FILE MODIFIED, Name : "/usr/lib/vmware-vlcm/vapi/py/com/vmware/vcenter/__pycache__/lcm_provider.cpython-37.pyc" at YYYY-MM-DDTHH:MM:SS
...
YYYY-MM-DDTHH:MM:SS [integrity_checker::log_and_print:integrity_checker.py:76] WARNING: [FILE_INTEGRITY_CHECK_FAILED] Reason : REGULAR FILE MODIFIED, Name : "/usr/lib/vmware-vstats/vstats_start.log" at YYYY-MM-DDTHH:MM:SS

/var/log/vmware/cloudvm/fileintegrity.log
...
YYYY-MM-DDTHH:MM:SS WARNING: [FILE_INTEGRITY_CHECK_FAILED] Reason : DIRECTORY MODIFIED, Name : "/usr/lib/applmgmt/timesync/py/vmware/appliance/timesync/__pycache__" at YYYY-MM-DDTHH:MM:SS
...
YYYY-MM-DDTHH:MM:SS WARNING: [FILE_INTEGRITY_CHECK_FAILED] Reason : REGULAR FILE MODIFIED, Name : "/usr/lib/vmware-vlcm/vapi/py/com/vmware/vcenter/__pycache__/lcm_provider.cpython-37.pyc" at YYYY-MM-DDTHH:MM:SS

Environment

VMware vCenter Server 7.x

Resolution

To workaround of this issue, recreate baseline information.

1. SSH to the VCSA using PuTTY or similar SSH client.
2. Enter the shell of the vCSA. (If the prompt shows command> that is the appliance shell. The below commands cannot be ran in appliance shell.).
   1. Run the below command (where the '#' represents the command line and does not need to be entered):
      # /usr/lib/vmware/site-packages/cis/integrity_checker.py -f baseline
# /usr/lib/vmware/site-packages/cis/integrity_checker.py -f check

Additional Information

syslog server received lots of the message with FILE_INTEGRITY_CHECK_FAILED related SRM server