NSX Management Cluster randomly reports "cluster degraded" due to invalid objects in the Exclusion list.

Products

• VMware NSX

Issue/Introduction

• Alarms for Cluster Degraded are observed with entries similar to the below present in /var/log/cbm/cbm.log

  WARN EventReportProcessor-1-4 EventReportSyslogSender 3509 MONITORING [nsx@6876 comp="nsx-manager" entId="########-####-####-############" eventFeatureName="clustering" eventSev="warning" eventState="On" eventType="cluster_degraded" level="WARNING" subcomp="cbm"] Group member ########-####-####-############ of service MANAGER is down.

• Log entries similar to the below will be observed in /var/log/proton/nsxapi.log

  ERROR GmleClientBlockingOpsThread-5 ShardLeadershipPredicate 1654885 POLICY [nsx@6876 comp="nsx-manager" errorCode="PM524001" level="ERROR" subcomp="manager"] Policy-Clustering - Cannot get the status of dependent entity Proton.

• There are issues with the Management service initializing due to an exception related to the exclusion list with log entries similar to the below observed in /var/log/proton/nsxapi.log

  INFO PolicyInitializer-1-7 PolicyInitializer 1161670 POLICY [nsx@6876 comp="nsx-manager" level="INFO" subcomp="manager"] Failed Initialization of com.vmware.nsx.management.policy.providers.security.excludelist.PolicyExcludeListInitServiceImpl

• Invalid object reported in the Exclusion list with entries similar to the below observed in /var/log/proton/proton-tomcat-wrapper.log
  

  INFO   | jvm 1533 | yyyy/mm/dd hh:mm:ss | com.vmware.nsx.management.common.exceptions.InvalidArgumentException: Invalid group with IPSet/MACAddress in ExclusionList path=[/infra/domains/default/groups/NSX-T_Exclusion_List]

• NSX Manager UI may report MANAGER down.

Note: The preceding log excerpts are only examples. Date, time, and environmental variables may vary depending on your environment.

Environment

VMware NSX

Cause

The Management service encounters constant initialization issues due to invalid objects in the Exclusion list. 

Resolution

This is a condition that may occur in a VMware NSX environment.

Workaround
See Resolution section of NSX Exclusion list modification fails due to invalid group with Ipset/MACAddress in FW Exclusion List (Error code:514051)" 

Additional Information

NSX Exclusion list modification fails due to invalid group with Ipset/MACAddress in FW Exclusion List (Error code:514051)"