NSX Edge disk usage high when vDefend feature is enabled

Products

• VMware NSX

Issue/Introduction

• Alarm on the Edge node reading Edge Health, Edge Disk Usage High. 

• Anti-Malware/Malware Prevention feature (vDefend) is enabled in System > NSX Application Platform.
• The disk free command (df) shows the root partition at or above the threshold (80% by default):
  #df -h
Filesystem                   Size  Used Avail Use% Mounted on
tmpfs                        3.1G  4.1M  3.1G   1% /run
/dev/sda4                     19G   15G  3.3G  82% /
tmpfs                         16G  4.9M   16G   1% /dev/shm
tmpfs                        5.0M     0  5.0M   0% /run/lock
tmpfs                        4.0M     0  4.0M   0% /sys/fs/cgroup
tmpfs                        1.0G   65M  960M   7% /mnt/ids
/dev/mapper/nsx-config        19G  6.3M   18G   1% /config
/dev/mapper/nsx-image         19G  2.6M   18G   1% /image
/dev/mapper/nsx-tmp          3.7G  312K  3.5G   1% /tmp
/dev/mapper/nsx-var+dump      56G   24K   53G   1% /var/dump
/dev/mapper/nsx-config__bak   19G   24K   18G   1% /config_bak
/dev/mapper/nsx-var+log       39G  4.5G   33G  13% /var/log
/dev/sda3                    943M  7.2M  871M   1% /boot
/dev/sda5                     19G   24K   18G   1% /os_bak
/dev/sda2                    499M  4.0K  499M   1% /boot/efi
overlay                       19G   15G  3.3G  82% /var/lib/docker/overlay2/###################################/merged
overlay                       19G   15G  3.3G  82% /var/lib/docker/overlay2/###################################/merged
overlay                       19G   15G  3.3G  82% /var/lib/docker/overlay2/###################################/merged
overlay                       19G   15G  3.3G  82% /var/lib/docker/overlay2/###################################/merged
overlay                       19G   15G  3.3G  82% /var/lib/docker/overlay2/###################################/merged
overlay                       19G   15G  3.3G  82% /var/lib/docker/overlay2/###################################/merged
overlay                       19G   15G  3.3G  82% /var/lib/docker/overlay2/###################################/merged
overlay                       19G   15G  3.3G  82% /var/lib/docker/overlay2/###################################/merged
overlay                       19G   15G  3.3G  82% /var/lib/docker/overlay2/###################################/merged
overlay                       19G   15G  3.3G  82% /var/lib/docker/overlay2/###################################/merged
overlay                       19G   15G  3.3G  82% /var/lib/docker/overlay2/###################################/merged
overlay                       19G   15G  3.3G  82% /var/lib/docker/overlay2/###################################/merged
overlay                       19G   15G  3.3G  82% /var/lib/docker/overlay2/###################################/merged
overlay                       19G   15G  3.3G  82% /var/lib/docker/overlay2/###################################/merged
overlay                       19G   15G  3.3G  82% /var/lib/docker/overlay2/###################################/merged
overlay                       19G   15G  3.3G  82% /var/lib/docker/overlay2/###################################/merged
overlay                       19G   15G  3.3G  82% /var/lib/docker/overlay2/###################################/merged
overlay                       19G   15G  3.3G  82% /var/lib/docker/overlay2/###################################/merged
overlay                       19G   15G  3.3G  82% /var/lib/docker/overlay2/###################################/merged
overlay                       19G   15G  3.3G  82% /var/lib/docker/overlay2/###################################/merged
overlay                       19G   15G  3.3G  82% /var/lib/docker/overlay2/###################################/merged
overlay                       19G   15G  3.3G  82% /var/lib/docker/overlay2/###################################/merged
overlay                       19G   15G  3.3G  82% /var/lib/docker/overlay2/###################################/merged
overlay                       19G   15G  3.3G  82% /var/lib/docker/overlay2/###################################/merged
overlay                       19G   15G  3.3G  82% /var/lib/docker/overlay2/###################################/merged
overlay                       19G   15G  3.3G  82% /var/lib/docker/overlay2/###################################/merged
overlay                       19G   15G  3.3G  82% /var/lib/docker/overlay2/###################################/merged
overlay                       19G   15G  3.3G  82% /var/lib/docker/overlay2/###################################/merged
tmpfs                        3.1G   12K  3.1G   1% /run/user/0.

 

Environment

VMware NSX 9.0.x

Cause

When the Anti-Malware/Malware Prevention feature is enabled, the system downloads several large container images required for the service. Currently, if the feature is later disabled or the service deployments are removed, these large images remain stored on the disk rather than being automatically cleared. 

Resolution

Workaround:

• If the Anti Malware is NOT being used, redeploy the Edge nodes with the alarm to restore disk usage back to normal levels.
  • Redeploy an NSX Edge Node or Using API calls to Redeploy Edge Node.
    
    
• If disabling the Anti-Malware is not possible, there is no available workaround to decrease disk usage. The only way to mitigate the issue is to adjust the alarm threshold to a level slightly higher than the current disk usage, for instance, approximately 85%. The Edge will still function normally at this disk usage level.
  
  • Configuring Alarm Definition Settings