Persistent SSP/NAPP Alarms in NSX After Platform Removal
search cancel

Persistent SSP/NAPP Alarms in NSX After Platform Removal

book

Article ID: 406927

calendar_today

Updated On:

Products

VMware vDefend Firewall with Advanced Threat Prevention VMware vDefend Firewall

Issue/Introduction

Multiple alarms showing in NSX UI even though NAPP has been removed. For example below alerts:

  • Napp Status Degraded 
  • Service Status Down
  • Service Status Degraded
  • Platform Disk Usage Very High
  • Platform Disk Usage High
  • Node Memory Usage High
  • Cluster Disk Usage High
  • Manager disconnected

 

Environment

NAPP 4.x

Cause

The alarm implementation relies on a framework client library that acts as the system’s source of truth for alarm states. In your current NSX environment, a known issue has not yet been fixed. Due to this, the alarms continue to report as active (true), even though the underlying services or components (like NAPP/SSP) are no longer present. This issue affects various alarm types, including:

  • tn_flow_exp_disconnected
  • nsx_application_platform_communication
  • manager_disconnected
  • And potentially others

Resolution

The fix will be implemented on a upcoming NSX version

Until the environment is upgraded, we recommend acknowledging the alarms. Acknowledging them ensures they won’t reappear for the same entity ID, even if the framework still reports them.

This is a supported and safe way to suppress these outdated alarms without modifying backend databases.

You can follow the steps below to identify and acknowledge the alarms via API on your NSX Manager. Since you have more than 1k+ alarms :

SSH into nsx manager with root account.

1. Get the Alarm IDs


Replace event_type with the specific type of alarm you're targeting (e.g., manager_disconnected, tn_flow_exp_disconnected, etc.)

curl -s -H 'X-NSX-Username:admin' -H 'content-type: application/json' "http://localhost:7449/phonehome-coordinator/api/v1/alarms?event_type=manager_disconnected"

 

Now the above output will give you the list of open alarms with a display_name and we need to capture the id's

Now reading through the long output maybe a tricky task and I have modified the same command above to only list the id's with the command below :

curl -s -H 'X-NSX-Username:admin' -H 'content-type: application/json' "http://localhost:7449/phonehome-coordinator/api/v1/alarms?event_type=manager_disconnected" | grep -o '"id" : "[^"]*"' | cut -d'"' -f4



2. Acknowledge the Alarms Using the IDs


Use the following curl command to acknowledge them:

curl -X POST   -H 'X-NSX-Username:admin'   -H 'content-type: application/json'   -ik   "http://localhost:7449/phonehome-coordinator/api/v1/alarms/?action=set_and_verify_status&new_status=ACKNOWLEDGED"   -d '{
    "ids": [
      "69da757b-2f11-416b-b3ce-2fd1a9e91785",
      "a4d34c28-b970-41a1-96a5-6945597012e0",
      "738d9edd-4a39-4018-9158-60e1850b9d86",
      "5a6c3274-3401-431e-a6e4-322af15d5a0d",
      "eb407c8b-c41c-4941-80b0-7a396c046e6e",
      "6bc4c565-a466-4df4-8167-b231c1ff5ca3",
      "cdc6f12d-2618-4125-ab87-c0d11f4d8e27",
      "d71a208f-e168-444c-8c3d-1817c0d66a49",
      "ea83c5eb-690f-4de3-87ea-1dbc5b4a54e6"
    ]
  }'



Output would look like below screen shot:





3.Repeat for each alarm type as necessary.