User cannot download LTA (Live Traffic Analysis) pcap file

Products

• VMware NSX

Issue/Introduction

• An LTA session is started and no error is observed during running the LTA session or after the completion of the session.
  
  
• UI says "Error: (Error code: 400)" when user clicks on download link of the file.
  
  
• Below log-lines may be seen on the NSX Managers, at /var/log/proton/nsxapi.log:
  
  2021-11-16T13:24:48.335Z INFO http-nio-127.0.0.1-7440-exec-23 NsxBaseRestController SYSTEM [nsx@6876 audit="true" comp="nsx-manager" level="INFO" subcomp="manager"] UserName:'null' ModuleName:'LiveTrace' Operation:'GET@/api/v1/livetraces/11/capturefile/834320bf###-####-####-####' Operation status: 'failure' Error: Packet capture action file is not found
2021-11-16T13:24:48.337Z INFO http-nio-127.0.0.1-7440-exec-25 LiveTraceFacadeImpl MONITORING [nsx@6876 comp="nsx-manager" level="INFO" reqId="343cb0f2-#####-####-####-##" subcomp="manager" username="admin"] Error occurred when get pcap file from manager, error: 400 : [{
  "details" : "Packet capture action file is not found",
  "httpStatus" : "BAD_REQUEST",
  "error_code" : 45013,
  "module_name" : "LiveTrace",
  "error_message" : "Packet capture action file is not found"
  
  
• If LTA pktcap API is used it also returns an error. Sample API call:
  GET@/api/v1/livetraces/11/proxy/reverse/capturefile'
Error: Operation status: 'failure' Error: "Failed to Fetch packet capture file due to file not exist or transmission error."
  
  
• If the LTA livetrace session is created on the src/dst port that is located on an Edge node, the below error may be seen in the /var/log/syslog of the edge node:
  "========================== certificate verification *** from failed ============================"

Environment

• VMware NSX-T 3.2.x
• VMware NSX 4.2.4 and later

Cause

Below are the probable causes:

1. NSX version 3.2.0 and later:/tmp directory of ESX host/ Edge node/ nsx-manager is full.
   
   
2. NSX version 4.2.4 and later:  An update of the FQDN/Certificate/Root CA Certificate of the NSX Manager was performed during the running of the LTA session. This is only applicable if the LTA livetrace session is created on a source/destination port that is located on an Edge node, and the below error is seen in the /var/log/syslog of the edge node:
   "========================== certificate verification *** from failed ============================"

Resolution

1. Applicable for Cause 1 and NSX version 3.2.0 or later:
   
   1. If LTA livetrace session is created on an ESXi port, clear the disk space in /tmp for ESX/nsx-manager and rerun the LTA session. 
   2. If LTA livetrace session is created on an Edge port, clear the disk space in /tmp for Edge node/nsx-manager and rerun the LTA session.
      
      
2. Applicable for Cause 2 and NSX version 4.2.4 or later: Just rerun the LTA session.