vSAN File Service soft quota alarms not triggering in vCenter

Products

• VMware vSAN

Issue/Introduction

Administrators utilizing vSAN File Services (OSA) may find that reaching a configured Soft Quota (capacity threshold) on a file share does not trigger a vCenter UI alarm or automated email notification. While the threshold is reached, the system may only reflect the status change within the Skyline Health Module without alerting the administrator through standard global alarm channels.

• File share capacity exceeds the user-defined Warning threshold in the vSphere Client.
• No standard Datastore Usage alarm is triggered for the specific file share event.
• The following event string is recorded internally in the host vsan-mgmt.log but does not appear in the vCenter Alarms task list: UsedCapacityOfThisShareExceedsTheSoftQuota
• Status changes are visible in vSAN Health but fail to generate proactive alerts (email/SNMP).

Environment

• vSAN File Services
• OSA and ESA

 

Cause

This behavior is Working as Designed due to the permanent architectural design of the vSAN File Service (OSA) notification framework.

The Soft Quota system utilized by vSAN File Services is technically decoupled from the global vCenter Alarms engine. While capacity thresholds can be configured within individual File Share settings, these events are categorized as file-service-specific metrics rather than standard Datastore-wide object events.

Key Technical Factors:

• Notification Decoupling: When a threshold is met, the system generates the internal event UsedCapacityOfThisShareExceedsTheSoftQuota for recording in the vsan-mgmt.log and reporting to the Skyline Health Module, but it does not automatically map to the vCenter UI alarm layer.
• Alarm Priority: Standard Datastore alarms monitor aggregate vSAN capacity. File-level warnings are often bypassed because global datastore thresholds (e.g., "Datastore usage on disk") are the primary triggers for system-wide vCenter notifications.

Resolution

This is a permanent architectural behavior of vSAN File Services (OSA). The "Soft Quota" is designed as a threshold for internal logging and health reporting rather than a trigger for the global vCenter Alarm engine.

To receive active notifications when these thresholds are met, administrators must implement one of the following workarounds.

1. Option 1: Create a Custom vCenter Alarm (Recommended)

   To receive proactive notifications, you must manually create an alarm that monitors the specific event string generated by the vSAN File Service.

   1. Navigate to Alarm Definitions: In the vSphere Client, select the Datacenter or Cluster level in the inventory, then go to Configure > Alarm Definitions.
   2. Add New Alarm: Click Add to create a new definition.
   3. Name and Target:
      • Alarm Name: Enter a descriptive name (e.g., vSAN File Service Soft Quota Warning).
      • Target Type: Set the target type to Datastores.
   4. Configure Triggers:
      • Select Event-based trigger and click Next.
      • Click Add to include a specific event.
      • Event String: Enter UsedCapacityOfThisShareExceedsTheSoftQuota exactly as shown.
   5. Set Actions:
      • Define your notification preference (e.g., Send email to admin).
      • Ensure the email server is configured in vCenter settings.
   6. Review and Activate: Click Next to review the configuration, then click Create to finalize and activate the alarm.
   7. For more details on managing multiple thresholds, refer to Broadcom KB 405718.

    

Option 2: Configure External Syslog Monitoring

If you utilize an external log management tool (such as VMware Aria Operations for Logs or a third-party SIEM), you can configure a proactive alert based on the specific log entries generated by the ESXi hosts.

1. Verify Syslog Export: Ensure that all ESXi hosts in the vSAN cluster are configured to export logs to your external syslog collector.
2. Define the Search Query: In your log management tool, create a search query or filter to monitor the vsan-mgmt.log stream.
3. Monitor Specific Event String: Filter for the following unique event identifier: UsedCapacityOfThisShareExceedsTheSoftQuota
4. Configure Alert Trigger:
   • Set the alert to trigger immediately upon a New Match of this string.
   • Include relevant metadata in the alert, such as the Hostname and the Datastore/Share name found in the log entry.
5. Set Notification Channel: Configure the external tool to send notifications via your preferred channel (Email, Slack, or PagerDuty) to ensure the infrastructure team is alerted even if the vCenter UI remains silent.