Identifying an unexpected MAC address change for a VM
Article ID: 424381
Updated On:
Products
Issue/Introduction
The Virtual Machine experienced an unexpected MAC address change on its primary NIC.
- In journalctl.log of the vCenter, you may find the entries below
MMM DD HH:MM:SS <vCenter FQDN> vpxd[44873]: Event [69844455] [1-1] [YYYY-MM-DD HH:MM:SS.086123Z] [vim.event.TaskEvent] [info] ["domain\user-name"] [<DataCenter>] [69844455] [Task: Initiate guest OS shutdown]MMM DD HH:MM:SS <vCenter FQDN> vpxd[44873]: Event [69844456] [1-1] [YYYY-MM-DD HH:MM:SS.095507Z] [vim.event.VmGuestShutdownEvent] [info] ["domain\user-name"] [<DataCenter>] [69844455] [Guest OS shut down for <VM-Name> on <Host-Name> in <DataCenter>]..MMM DD HH:MM:SS <vCenter FQDN> vpxd[44873]: Event [69844457] [1-1] [YYYY-MM-DD HH:MM:SS.407638Z] [vim.event.EventEx] [info] [] [<DataCenter>] [69844457] [Virtual machine <VM-Name> in cluster <Cluster name> in <DataCenter> is not vSphere HA Protected.]MMM DD HH:MM:SS <vCenter FQDN> vpxd[44873]: Event [69844458] [1-1] [YYYY-MM-DD HH:MM:SS.083374Z] [vim.event.VmPoweredOffEvent] [info] [] [<DataCenter>] [69844458] [<VM-Name> on <Host-Name> in <DataCenter> is powered off]..MMM DD HH:MM:SS <vCenter FQDN> vpxd[44873]: Event [69844471] [1-1] [YYYY-MM-DD HH:MM:SS.80885Z] [vim.event.VmReconfiguredEvent] [info] ["domain\user-name"] [<DataCenter>] [69844468] [Reconfigured <VM-Name> on <Host-Name> in <DataCenter>. Modified: config.hardware.device(4001).backing.port.portKey: "1420" -> "1416"; config.hardware.device(4001).backing.port.connectionCookie: 760847393 -> 1781488634; config.hardware.device(4001).addressType: "assigned" -> "manual"; config.memoryAllocation.overheadLimit: 141 -> <unset>; Added: Deleted: ]..MMM DD HH:MM:SS <vCenter FQDN> vpxd[44873]: Event [69844615] [1-1] [YYYY-MM-DD HH:MM:SS.530933Z] [vim.event.VmGuestShutdownEvent] [info] ["domain\user-name"] [<DataCenter>] [69844614] [Guest OS shut down for <VM-Name> on <Host-Name> in <DataCenter>]..MMM DD HH:MM:SS <vCenter FQDN> vpxd[44873]: Event [69844626] [1-1] [YYYY-MM-DD HH:MM:SS.164011Z] [vim.event.TaskEvent] [info] ["domain\user-name"] [<DataCenter>] [69844626] [Task: Reconfigure virtual machine]MMM DD HH:MM:SS <vCenter FQDN> vpxd[44873]: Event [69844627] [1-1] [YYYY-MM-DD HH:MM:SS.319284Z] [vim.event.VmMacChangedEvent] [warning] [] [<DataCenter>] [69844627] [Changed MAC address from ##:##:##:##:##:## to ##:##:##:##:##:## for adapter dv-v201_SrvData_192.168.1/24 for <VM-Name>]..MMM DD HH:MM:SS <vCenter FQDN> vpxd[44873]: Event [69844630] [1-1] [YYYY-MM-DD HH:MM:SS.340818Z] [vim.event.VmReconfiguredEvent] [info] ["domain\user-name"] ["DataCenter"] [69844626] [Reconfigured <VM-Name> on <Host-Name> in "DataCenter". Modified: config.hardware.device(4001).backing.port.portKey: "1416" -> "1420"; config.hardware.device(4001).backing.port.connectionCookie: 1781488634 -> 446550678; config.hardware.device(4001).addressType: "manual" -> "assigned"; config.hardware.device(4001).macAddress: "##:##:##:##:##:##" -> "##:##:##:##:##:##"; Added: Deleted: ]
- In /var/log/vmware/vpxd/vpxd.log in the vCenter, we would see similar entries given below
YYYY-MM-DD HH:MM:SS info vpxd[45066] [Originator@6876 sub=VmProv opID=mglpgw42-1130325-auto-o85y-h5:70199731-1c-01] Applying ConfigSpec (vim.vm.ConfigSpec) {--> changeVersion = "YYYY-MM-DD HH:MM:SS.214145Z",--> createDate = "YYYY-MM-DD HH:MM:SS.746233Z",--> deviceChange = (vim.vm.device.VirtualDeviceSpec) [--> (vim.vm.device.VirtualDeviceSpec) {--> operation = "edit",--> device = (vim.vm.device.VirtualVmxnet3) {--> key = 4001,--> deviceInfo = (vim.Description) {--> label = "Network adapter 2",--> summary = "DVSwitch: 26 aa bb cc c7 a3 74 14-27 65 00 7e aa bb cc 9c"--> },--> backing = (vim.vm.device.VirtualEthernetCard.DistributedVirtualPortBackingInfo) {--> port = (vim.dvs.PortConnection) {--> switchUuid = "26 aa bb cc c7 a3 74 14-27 65 00 7e aa bb cc 9c",--> portgroupKey = "dvportgroup-74526",--> portKey = "1420",--> connectionCookie = 446550678--> }--> },--> connectable = (vim.vm.device.VirtualDevice.ConnectInfo) {--> migrateConnect = "unset",--> startConnected = false,--> allowGuestControl = true,--> connected = false,--> status = "untried"--> },--> slotInfo = (vim.vm.device.VirtualDevice.PciBusSlotInfo) {--> pciSlotNumber = 256--> },--> controllerKey = 100,--> unitNumber = 8,--> addressType = "manual",--> macAddress = "##:##:##:##:##:##",--> wakeOnLanEnabled = true,--> uptCompatibilityEnabled = true,--> uptv2Enabled = false,--> },--> }--> ],--> virtualNuma = (vim.vm.VirtualNuma) {--> },
- In /var/run/log/hostd.log in the ESXi host, we would see similar entries given below
YYYY-MM-DD HH:MM:SS.258Z In(166) Hostd[2099347]: [Originator@6876 sub=Vimsvc.ha-eventmgr opID=mglpgw42-1130325-auto-o85y-h5:70199731-1c-01-ad-0175 sid=52641713 user=vpxuser:"domain\user-name"] Event 19623 : Reconfigured <VM-Name> on <Host-Name> in ha-datacenter.YYYY-MM-DD HH:MM:SS.258Z In(166) Hostd[2099262]: -->YYYY-MM-DD HH:MM:SS.258Z In(166) Hostd[2099262]: --> Modified:YYYY-MM-DD HH:MM:SS.258Z In(166) Hostd[2099262]: -->YYYY-MM-DD HH:MM:SS.258Z In(166) Hostd[2099262]: --> Added:YYYY-MM-DD HH:MM:SS.258Z In(166) Hostd[2099262]: -->YYYY-MM-DD HH:MM:SS.258Z In(166) Hostd[2099262]: --> Deleted:YYYY-MM-DD HH:MM:SS.258Z In(166) Hostd[2099262]: -->YYYY-MM-DD HH:MM:SS.258Z In(166) Hostd[2099262]: -->
Environment
- vCenter 7.x
- vCenter 8.x
- vCenter 9.x
Resolution
Confirm with the user "domain\user-name" for more details on this change.
Additional Information
Feedback
