Configure vCenter alarms for "Duplicate IP address detected on interface vmk" VMkernel Observations(VOB) message

Products

• VMware vCenter Server
• VMware vCenter Server 8.0

Issue/Introduction

In some situation, a duplicate IP address was detected with a vmknic interface on ESXi host.

The event was reported in vobd.log file (var/run/log/vobd.log).

Example:

--/var/run/log/vobd.log

[YYYY-MM-DDTHH:MM:SS]: [netCorrelator] #############us: [esx.problem.net.vmknic.ip.duplicate] Duplicate IP address detected for ###.###.##.## on interface vmk1, current owner being ##:##:##:##:##:##

Environment

VMware vSphere 7.x
VMware vSphere 8.x

Cause

If it's plan to monitor this event with vCenter alarm, it could be added by manually.

Resolution

Follow the steps mentioned below to register the alarm manually:

1. Navigate to vCenter Server -> Configure -> Alarm Definitions

2. Click Add

3. Input alarm name "Duplicate IP address detected with vmk".

4. Choose the "Target type" as Hosts and click Next

5. In the "Alarm Rule1" page, Input "esx.problem.net.vmknic.ip.duplicate" as the trigger condition

6. Select severity as "Show as Warning"

7. Optionally, you can configure email notification or SNMP traps or running any script whenever such alarm is triggered

8. Click Next

9. In the Review page, verify if the alarm rules is set correctly and make sure the "Enable this alarm" option is enabled.

10. Click CREATE.