Orphaned/unknown .ses and .vmfd files found in the Virtual Machine directory

Products

• VMware vSphere ESXi
• VMware vCenter Server

Issue/Introduction

• .ses and .vmfd files are present in the directories of multiple virtual machines in vCenter.
• No active Virtual Machine protection plugins or storage policies are configured on the affected Virtual Machines.
• ESXi hosts running the affected Virtual Machines show the vmwarelwd I/O filter configured at the host level. 

Cause

The affected virtual machines retained the vmwarelwd I/O filter from a previously decommissioned VCDR deployment. Although VCDR was removed, the associated I/O filter configuration was not fully cleaned up, resulting in residual filter associations on the Virtual Machines. These stale associations caused the continued creation of .ses and .vmfd files within the Virtual Machine directories.

Resolution

Impact/Risks:
Removal of the vmwarelwd filter from a Virtual Machine that is being protected requires re-enabling it on the Virtual Machine at a later point. The execution of the attached script should be performed only against Virtual Machines that are no longer to be protected by VMware Cloud Disaster Recovery(VCDR) or other solutions that leverage the vmwarelwd filter. The attached utility will not reconfigure a Virtual Machine to remove any filter other than that of the vmwarelwd I/O filter.

Remove the vmwarelwd I/O filter from the affected Virtual Machines:

1. Take a vCenter snapshot. If the vCenter Server is running in linked mode, take offline snapshots of all linked vCenter Servers before proceeding.
2. Establish an SSH session to the impacted vCenter Server.
3. Execute the attached lwd-cleanup-util.py script to verify if the affected Virtual Machines are listed with the vmwarelwd I/O filter association.
   • Command: ./lwd-cleanup-util.py --list -u [email protected]
   • This should list all the affected Virtual Machines.
4. Run the LWD cleanup utility to remove the decommissioned VCDR's vmwarelwd I/O filter from all affected Virtual Machines:
   • Command: ./lwd-cleanup-util.py -d --all -u [email protected]
   • This will remove the vmwarelwd I/O filter from all the Virtual Machines in the vCenter.
5. Execute Step 3 again to verify the filter is removed.
6. Verify if the .ses and .vmfd files are removed from the virtual machine directory.
   
   

Expected Result

• .ses and .vmfd files will no longer be created for the affected Virtual Machines.
• The environment will be fully cleaned of legacy VCDR vmwarelwd I/O filter associations.

Additional Information

What is vmwarelwd?
VMware LWD (Lightweight Delta) is a specialized I/O filter technology used in Dell PowerProtect Data Manager (PPDM), VMware Cloud Disaster Recovery (VCDR) and similar solutions to enable efficient, low-impact snapshot-based backups and replication for virtual machines on VMware's vSphere platform by intercepting disk I/O, minimizing Virtual Machine stun time, and tracking changes.

Putting ESXi into maintenance mode, vMotioning, or reconfiguring a VM fails, or snapshots are slow, due to the vmwarelwd ioFilter being attached