syslog server received lots of the message with FILE_INTEGRITY_CHECK_FAILED related to vCenter server

Products

• VMware vCenter Server

Issue/Introduction

The warning [FILE_INTEGRITY_CHECK_FAILED] was observed in the syslog server which was originating from the vCenter Appliance (XXXXXX)

/var/log/vmware/applmgmt/backup.log
...
YYYY-MM-DDTHH:MM:SS [integrity_checker::log_and_print:integrity_checker.py:76] WARNING: [FILE_INTEGRITY_CHECK_FAILED] Reason : REGULAR FILE MODIFIED, Name : "/usr/lib/vmware-vlcm/vapi/py/com/vmware/vcenter/__pycache__/lcm_provider.cpython-37.pyc" at YYYY-MM-DDTHH:MM:SS
...
YYYY-MM-DDTHH:MM:SS [integrity_checker::log_and_print:integrity_checker.py:76] WARNING: [FILE_INTEGRITY_CHECK_FAILED] Reason : REGULAR FILE MODIFIED, Name : "/usr/lib/vmware-vstats/vstats_start.log" at YYYY-MM-DDTHH:MM:SS

/var/log/vmware/cloudvm/fileintegrity.log
...
YYYY-MM-DDTHH:MM:SS WARNING: [FILE_INTEGRITY_CHECK_FAILED] Reason : DIRECTORY MODIFIED, Name : "/usr/lib/applmgmt/timesync/py/vmware/appliance/timesync/__pycache__" at YYYY-MM-DDTHH:MM:SS
...
YYYY-MM-DDTHH:MM:SS WARNING: [FILE_INTEGRITY_CHECK_FAILED] Reason : REGULAR FILE MODIFIED, Name : "/usr/lib/vmware-vlcm/vapi/py/com/vmware/vcenter/__pycache__/lcm_provider.cpython-37.pyc" at YYYY-MM-DDTHH:MM:SS

Environment

VMWare vCenter 7.x

VMWare vCenter 8.x

Cause

The integrity_checker.py script detected 49 modified files (primarily Python __pycache__ entries and specific binaries), which acts as a showstopper for the Backup Manager in vCenter.

Resolution

To workaround of this issue, recreate baseline information.

1. SSH to the VCSA using PuTTY or similar SSH client.
2. Reset the integrity baseline: /usr/lib/vmware/site-packages/cis/integrity_checker.py -f baseline
3. Verify the new baseline: /usr/lib/vmware/site-packages/cis/integrity_checker.py -f check
4. Retry the vCenter backup.

Additional Information

syslog server received lots of the message with FILE_INTEGRITY_CHECK_FAILED related SRM server