NSX application crash alarm on NSX manager UI

Products

• VMware NSX
• VMware vDefend Firewall

Issue/Introduction

Alarm info: NSX application crash alarm on NSX manager UI

Description
Application on NSX xxx has crashed. The number of core files found is 1. Collect the Support Bundle including core dump files and contact VMware Support team.

Recommended Action
Collect Support Bundle for NSX node xxx using NSX Manager UI or API. Note, core dumps can be set to move or copy into NSX Tech Support Bundle in order to remove or preserve the local copy on node. Copy of Support Bundle with core dump files is essential for VMware Support team to troubleshoot the issue and it is best recommended to save a latest copy of Tech Support Bundle including core dump files before removing core dump files from system. Refer KB article for more details. 

 

Log info:
vobd.log
2025-08-05T03:27:57.041Z In(14) vobd[2097768]: [UserWorldCorrelator] 4193814805617us: [vob.uw.core.dumped] /usr/lib/vmware/nsx-idps/bin/nsx-idps(2103952) /var/core/nsx-idps-zdump.000
2025-08-05T03:27:57.041Z In(14) vobd[2097768]: [UserWorldCorrelator] 4193849130648us: [esx.problem.application.core.dumped] An application (/usr/lib/vmware/nsx-idps/bin/nsx-idps) running on ESXi host has crashed (1 time(s) so far). A core file may have been created at /var/core/nsx-idps-zdump.000.
2025-08-05T03:32:31.441Z In(14) vobd[2097768]: [UserWorldCorrelator] 4194089203914us: [vob.uw.core.dumped] /usr/lib/vmware/nsx-idps/bin/nsx-idps(25426798) /var/core/nsx-idps-zdump.001
2025-08-05T03:33:27.627Z In(14) vobd[2097768]: [UserWorldCorrelator] 4194145388942us: [vob.uw.core.dumped] /usr/lib/vmware/nsx-idps/bin/nsx-idps(25428374) /var/core/nsx-idps-zdump.002
2025-08-05T03:36:30.607Z In(14) vobd[2097768]: [UserWorldCorrelator] 4194328367554us: [vob.uw.core.dumped] /usr/lib/vmware/nsx-idps/bin/nsx-idps(25428682) /var/core/nsx-idps-zdump.003

nsx-syslog
2025-08-05T03:27:57.137Z In(182) vdpi[2104290]: NSX 2104290 - [nsx@6876 comp="nsx-esx" subcomp="nsx-vdpi" tid="2104896" level="INFO"] libdvfilteruser: Consumer process disconnected
2025-08-05T03:27:57.137Z In(182) cfgAgent[2103675]: NSX 2103675 - [nsx@6876 comp="nsx-controller" subcomp="cfgAgent" tid="2E14E700" level="info"] ids: IDSEngine::monitorProcess: Detected IDS Engine restart. Re-establishing communication
2025-08-05T03:27:57.172Z No(173) nsx-idps[25426798]: [25426798] <Notice> -- This is Suricata version 5.0.10 RELEASE running in SYSTEM mode
2025-08-05T03:27:57.172Z In(174) nsx-idps[25426798]: [25426798] <Info> -- CPUs/cores online: 64
2025-08-05T03:27:57.180Z In(174) nsx-idps[25426798]: [25426798] <Info> -- HTTP memcap: 134217728
2025-08-05T03:27:57.182Z In(174) nsx-idps[25426798]: [25426798] <Info> -- FTP memcap: 134217728
2025-08-05T03:27:57.186Z No(173) nsx-idps[25426798]: [25426798] <Notice> -- NFS protocol parsing disabled.
2025-08-05T03:27:57.225Z In(174) nsx-idps[25426798]: [25426798] <Info> -- Using PCRE match-limit setting of: 1500

Environment

VMware NSX 4.1.2.5

Cause

The content snip had incorrect packet size in case the dynamic allocation for packet data failed. Subsequent packets in the flow tried to clear packets from the snip structure as packets_size was incorrect.

Resolution

Upgrade to the fixed versions 4.2.0 and later.

VCF NSX 9.0 and later.