Admission Failure in path: host/vim/vmvisor/envoy Causes ESXi Hosts to Show as Not Responding in vCenter

Products

• VMware vSphere ESXi

Issue/Introduction

In the vmkernel.log, you observe repeated admission failure messages similar to:

In(XXX) vmkernel: cpuXX:XXXXX) Admission failure in path: host/vim/vmvisor/envoy: envoy.<ID1>: uw.<ID2>
In(XXX) vmkernel: cpuXX:XXXXX) uw.<ID2> (<PID>) requires 1024 KB, asked 1024 KB from envoy (<ENV_ID>) which has 122880 KB occupied and 0 KB available.
In(XXX) vmkernel: cpuXX:XXXXX) Admission failure in path: host/vim/vmvisor/envoy: envoy.<ID1>: uw.<ID2>
In(XXX) vmkernel: cpuXX:XXXXX) uw.<ID2> (<PID>) requires 1028 KB, asked 1028 KB from envoy (<ENV_ID>) which has 122880 KB occupied and 0 KB available.
In(XXX) vmkernel: cpuXX:XXXXX) uw.<ID2> (<PID>) requires 8 KB, asked 8 KB from envoy (<ENV_ID>) which has 122880 KB occupied and 6 KB available.

The vmsyslogd daemon crashes repeatedly due to excessive log volume.

The hidden error file /var/log/.vmsyslogd.err.* shows:

vmsyslog               : CRITICAL] vmsyslogd daemon starting (<PID>)
vmsyslog.main          : CRITICAL] Dropping messages due to log stress (qsize = <VALUE>)

vmsyslog               : CRITICAL] vmsyslogd daemon starting (<PID>)
vmsyslog.main          : CRITICAL] Dropping messages due to log stress (qsize = <VALUE>)

Environment

VMware vSphere ESXi 7.x
VMware vSphere ESXi 8.x

Cause

The excessive kernel log entries are triggered because vmsyslogd repeatedly runs out of memory.
This happens when one or more logging clients generate logs at an abnormally high rate.

One common cause is DFW (Distributed Firewall) packet logs, which can quickly produce extremely high log volumes.

Resolution

1. Verify if DFW Packet Logging Is Enabled

Check whether DFW packet logs are being generated:/var/log/dfwpktlogs.log

If you observe rapid log growth, DFW L2 rule logging is likely the cause.

2. Disable Logging on the Default L2 Rule

It is not recommended to enable logging on the default L2 Ethernet DFW rule in production environments for any sustained period.
If logging is required, create a dedicated L2 rule for the targeted traffic and enable logging only on that specific rule.

3.Steps to Disable L2 Rule Logging

1. Log in to the NSX-T Manager UI.

2. Navigate to Security > Distributed Firewall.

3. Click the Ethernet tab and locate the Default Layer2 Rule.

4. Click the settings icon for that rule and disable Logging.

5. Click Apply, then Publish the changes.