Encrypted VM Fails to Power On Due to Missing .vmfd Sidecar File
search cancel

Encrypted VM Fails to Power On Due to Missing .vmfd Sidecar File

book

Article ID: 428144

calendar_today

Updated On:

Products

VMware vSphere ESXi

Issue/Introduction

An encrypted virtual machine (utilizing vSphere VM Encryption) hosted on a vSAN datastore fails to power on after disk reconfiguration operations (such as adding, removing, or renaming virtual disks). Despite the underlying vSAN objects reporting a healthy and compliant status, the virtual machine remains inaccessible.

The following symptoms and log signatures are observed:

  • vSphere Client Error: An error was received from the ESXi host while powering on VM <VM_Name>. Unable to find the object. Not enough resources to power on.

  • Virtual Machine log (/vmfs/volumes/DatastoreUUID/VMname/vmware.log):

    yyyy-mm-ddThh:mm:ss.###Z In(05) worker-4473420 - OBJLIB-FILEBE : FileBEOpen: can't open '/vmfs/volumes/vsan:####-####/###-###-###-###-####/VM_1-###.vmfd' : Could not find the file (393218). 
    yyyy-mm-ddThh:mm:ss.###Z In(05) worker-4473420 - OBJLIB-encObjBE :EncObjBEOpen: Failed to Open object: Could not find the file (393218). 
    yyyy-mm-ddThh:mm:ss.###Z In(05) worker-4473420 - SidecarOpenInt: Failed to open sidecar file '/vmfs/volumes/vsan:####-####/###-###-###-###-####/VM_1-###.vmfd' with flags 2013, Could not find the file (60002). 
    yyyy-mm-ddThh:mm:ss.###Z In(05) worker-4473420 - DISKLIB-LIB_SIDECAR : DiskLibSidecarOpenInt: Failed to open sidecar for filter 'vmwarevmcrypt_1': Could not find the file.
... 
    yyyy-mm-ddThh:mm:ss.###Z In(05)+ vmx - Power on failure messages: Object not found 
    yyyy-mm-ddThh:mm:ss.###Z In(05)+ vmx - Cannot open the disk '/vmfs/volumes/vsan:####-####/###-###-###-###-####/VM_1-###.vmfd' or one of the snapshot disks it depends on. 
    yyyy-mm-ddThh:mm:ss.###Z In(05)+ vmx - Module 'Disk' power on failed. 
    yyyy-mm-ddThh:mm:ss.###Z In(05)+ vmx - Failed to start the virtual machine.

  • ESXi Host Daemon log (/var/run/log/hostd.log):

    yyyy-mm-ddThh:mm:ss.###Z Db(167) Hostd[2102147]: [Originator@6876 sub=Vigor.Vmsvc.vm:/vmfs/volumes/vsan:####-####/###-###-###-###-####/VM.vmx] Power On message: Object not found 
    yyyy-mm-ddThh:mm:ss.###Z Db(167) Hostd[2102097]: --> Cannot open the disk '/vmfs/volumes/vsan:####-####/###-###-###-###-####/VM.vmdk' or one of the snapshot disks it depends on.

  • Directory Auditing: 

To validate

1. SSH to ESXi

2. Goto Path: /vmfs/volumes/DatastoreUUID/VMname/

3. run : ls -altrh

The number of virtual disk descriptor files (.vmdk) exceeds the number of virtual machine filter descriptor files (.vmfd). For example, if there are 11 .vmdk files but only 10 .vmfd files, the .vmfd sidecar file for the active boot disk (e.g., vmdisk1.vmfd) is missing.

Environment

VMware vSphere ESXi 8.x

Cause

The issue is caused by the absence or naming mismatch of the .vmfd (Virtual Machine Filter Descriptor) sidecar file associated with an encrypted virtual disk (.vmdk).

For encrypted virtual machines, the .vmfd file is a critical sidecar metadata store used by the vmwarevmcrypt disk filter. It contains the key association metadata (such as Key IDs and Key encryption pointers) needed to retrieve the Data Encryption Key (DEK) from the Key Provider.

If this file is deleted, missing, or mismatched:

  1. The virtual machine monitor (VMM) cannot initialize the encryption filter (vmwarevmcrypt).

  2. The hypervisor cannot unlock or decrypt the storage extents of the virtual disk.

  3. The power-on operation aborts with a VM kernel disk initialization failure, even if the underlying vSAN storage object remains physically healthy.

This mismatch typically occurs when manual virtual disk renaming operations are performed using the standard ESXi Shell mv command instead of the VMware-recommended vmkfstools -E utility. The mv command only renames the specific target file, whereas vmkfstools dynamically renames and updates the descriptor, extents, and any associated encryption sidecars (.vmfd).

Resolution

If the .vmfd file is completely deleted and cannot be recovered from storage trash blocks or backup repositories, the virtual disk data is permanently unrecoverable. Because the encryption keys cannot be re-associated with the target disk descriptor, there is no supported utility or command sequence to reconstruct a missing .vmfd from scratch.

  • Workaround: The virtual machine or the affected virtual disk must be restored from a previous healthy backup.

Note: If the .vmfd File is Present but Naming is Mismatched, Please reach out to Broadcom Technical Support.

Additional Information

 

  • The .vmfd file is mandatory for encrypted virtual disks and is unique per disk.

  • vSAN object health alone does not guarantee recoverability for encrypted disks.

  • Disk add/remove operations on encrypted VMs should always be performed with caution and validated backups in place.

  • Broadcom does not support manual recreation of encryption metadata files.

 

Powered by Wolken Software