ESXi host "Not Responding" in vCenter Server due to 100% full /etc ramdisk

Products

• VMware vSphere ESXi

Issue/Introduction

This article addresses an issue where VMware vSphere ESXi hosts become unresponsive in vCenter Server due to the exhaustion of the /etc ramdisk. This exhaustion is caused by the uncontrolled growth of the Kerberos credential cache file used by the Likewise Identity Service when the host is integrated with Active Directory.

The following error message is displayed in the vCenter Server user interface (UI):


Running vdf -h on the host SSH shows the etc ramdisk at 100% utilization.

A large file (e.g., 25MB+) located at /etc/likewise/lib/krb5cc_lsass

Environment

VMware vSphere ESXi 7.x
VMware vSphere ESXi 8.x

Cause

By default, the ESXi etc ramdisk has a fixed capacity. The Likewise Identity Service (lwsmd), which handles Active Directory authentication, manages a Kerberos credential cache (krb5cc_lsass).
In some environments, this cache file does not have a default size limit. Over time, or during periods of high authentication activity, the file expands until it consumes the entire etc ramdisk. Because this partition is critical for system configuration files, its exhaustion causes management services (hostd, vpxa) to deadlock or crash.

Resolution

If the ESXi host is "Not Responding" in vCenter and the /etc ramdisk is 100% full, perform the following steps to restore connectivity:

1. Log in to the affected ESXi host via SSH as root.
2. Move the Kerberos credential cache file from the full /etc partition to /var/core to immediately free up space:
   mv /etc/likewise/lib/krb5cc_lsass /var/core/
3. Start the Likewise service and restart the host management agents:
   /etc/init.d/lwsmd start
/etc/init.d/hostd restart
/etc/init.d/vpxa restart