Persistent "NAPP Status Degraded" Alarm on NSX 4.2.1 following SSP Outage Recovery

Products

• VMware vDefend Firewall with Advanced Threat Prevention

Issue/Introduction

Symptoms:

• A napp_status_degraded alarm is triggered and remains open in the NSX Manager UI.

• The alarm automatically recurs 4 to 5 hours after being manually resolved by an administrator.

• All Security Services Platform (SSP) health APIs (e.g., /napp/api/v1/platform/monitor/feature/health) and the SSP Alarms UI report the cluster as fully healthy.

• The environment recently experienced and recovered from an infrastructure outage, such as an Out-of-Memory (OOM) event. (After recovery using the KB: 425275)

Environment

• NSX Manager: 4.2.1.x (any 4.2.1 patch release)

• Security Services Platform (SSP): 5.1.0

Cause

Historically, NSX Manager monitors NAPP/SSP health via periodic Kafka messages. These messages contained a specific health status field indicating whether the platform was "STABLE" or "DEGRADED."

1. During the initial outage (e.g., OOM), the platform correctly sent a "DEGRADED" status, raising the napp_status_degraded alarm on the NSX Manager.

2. After the platform recovered, SSP resumed sending its periodic Kafka messages. However, SSP 5.1 operates in a modern, decoupled architecture and no longer includes the legacy health status field in these heartbeat messages.

3. Because NSX 4.2.1 still expects this field, it interprets the missing data as an "INVALID" state (K8S_HEALTH_INVALID).

4. NSX Manager requires an explicit "STABLE" message to clear the alarm. Because it only sees "INVALID", the alarm cannot auto-resolve. Furthermore, if the alarm is manually resolved in the UI, the NSX alarm framework will re-evaluate the "INVALID" state during its next sync cycle (every 4-5 hours) and falsely re-raise the alarm.

Resolution

This issue is a known architectural mismatch and is permanently resolved in NSX 4.2.2 and later releases.

In NSX 4.2.2+, this specific legacy alarm logic is intentionally deprecated and removed for decoupled SSP environments.

Workaround:

For environments running NSX 4.2.1.x, the recommended workaround is to disable the legacy napp_status_degraded alarm definition in the NSX Manager UI.

Note: Disabling this alarm is safe and will not impact your visibility into actual platform health. SSP 5.1 utilizes its own independent alarms framework. Administrators should monitor the true health of the platform directly via the SSP UI.

Steps to disable the legacy alarm:

1. Log in to the NSX Manager UI.

2. Navigate to the top navigation bar and click Alarms, then select the Alarm Definitions tab.

3. Search for the NAPP Status Degraded alarm.

4. Click the vertical ellipsis (three dots) icon next to the alarm and select Edit.

5. Turn off the Enabled toggle to disable the detection of the alarm.

6. Click Save.