Unplanned ESXi Host Maintenance Mode Initiated by Zerto Service Account API Request

Products

• VMware vCenter Server

Issue/Introduction

VMware vCenter Server registers an unplanned maintenance mode event for an ESXi host. There are no active upgrades or administrative tasks occurring during the event timeframe.

Review of the vpxd.log file indicates a third-party session initiated the enterMaintenanceMode task:

Plaintext

 

info vpxd[06037] [Originator@6876 sub=vpxLro opID=6173f7a0] [VpxLRO] -- BEGIN task-9022152 -- host-##-- vim.HostSystem.enterMaintenanceMode -- SESSION ID(SESSION ID) 

Cross-referencing the session ID (SESSION ID) in the vpxd-profiler.log maps the request to the Zerto service account and its originating IP:

Plaintext

 

--> /SessionStats/SessionPool/Session/Id='SESSION ID'/Username='domainname\serviceaccount'/ClientIP='###.###.###.###'/PropertyCollector/LastVersionNum/total 281 

 

Environment

VMware vCenter Server

VMware ESXi

Cause

The third-party Zerto application erroneously issued an authenticated API request to place the host into maintenance mode due to a false positive detection of a host upgrade in vCenter. 

Resolution

• Review vpxd.log and vpxd-profiler.log to confirm the maintenance mode API call was initiated by the Zerto service account session ID.

• Verify via change control and vCenter logs that no valid host upgrade activity was occurring at the time of the event.

• Engage Zerto technical support to investigate the cause that triggered the API call.