Remote access for ESXi local user account 'nsx-user' has been locked for 900 seconds after 0 failed login attempts.

Products

• VMware vSphere ESXi

Issue/Introduction

Due to lack of space user(service account) cannot log in and you constantly receiving this message

Remote access for ESXi local user account 'nsx-user' has been locked for 900 seconds after 0 failed login attempts.

 

On ESXI in hostd.logs you see following 

 

info hostd[2104655] [Originator@6876 sub=Vimsvc.ha-eventmgr] Event 2982206 : Remote access for ESXi local user account 'nsx-user' has been locked for 900 seconds after 0 failed login attempts.
error hostd[2105857] [Originator@6876 sub=Default opID=665852a0] [module:pam_lsass]LsaPamGetCurrentPassword failed [error code: 49929]
error hostd[2105857] [Originator@6876 sub=Default opID=665852a0] [module:pam_lsass]pam_sm_authenticate: failed [error code:49929]
verbose hostd[2105016] [Originator@6876 sub=Solo.Vmomi opID=665852a0] Arg userName:
--> "nsx-user"
verbose hostd[2105016] [Originator@6876 sub=Solo.Vmomi opID=665852a0] Arg password:
--> (not shown)
-->
verbose hostd[2105016] [Originator@6876 sub=Solo.Vmomi opID=665852a0] Arg locale:
--> (null)
info hostd[2105016] [Originator@6876 sub=Solo.Vmomi opID=665852a0] Throw vim.fault.InvalidLogin
info hostd[2105016] [Originator@6876 sub=Solo.Vmomi opID=665852a0] Result:
--> (vim.fault.InvalidLogin)
...
...
-->  eventTypeId = "esx.problem.visorfs.ramdisk.full",
-->  arguments = (vmodl.KeyAnyValue) [
-->    (vmodl.KeyAnyValue) {
-->     key = "1",
-->     value = "var"
-->    },
-->    (vmodl.KeyAnyValue) {
-->     key = "2",
-->     value = "/var/run/vmware-hostd-ticket/#####-#####-###-########"

 

Follow steps from this article  Identifying and Resolving Full Ramdisk Issues in ESXi Environments to identify what is consuming space.

 

You see this as result 

-rw-rw-r-- 1 svcdatamover om_vmware_support  47M Aug 17 21:01 nsxaVim.err

 

Ramdisk /var/ normally is 48 MB in size in this case above file consumes almost all of space hence causing failures.

Environment

vSphere 8.x

Cause

Ramdisk space in ESXi can become fully consumed due to large log files or other temporary data accumulating in directories that are not redirected to persistent storage. This often occurs in the /var directory, which is typically mounted as a ramdisk for performance reasons. This ramdisk is often used by plug-ins and add-on products for ESXi which may fill it up when experiencing unintended problems with log rotation.

 

Resolution

To resolve this apply steps from article Large nsxaVim.err file causing full ramdisk on the ESXi