NSX virtual edges report FILE_INTEGRITY_CHECK_FAILED alert for reboot_cmds.py

Products

• VMware NSX

Issue/Introduction

• You may observe Splunk alerts indicating a FILE_INTEGRITY_CHECK_FAILED error originating from several virtual edges within your NSX environment.
• The alerts specifically flag that a regular file has been deleted, displaying the following message:  [FILE_INTEGRITY_CHECK_FAILED] Reason : REGULAR FILE DELETED, Name : "/usr/lib/ubuntu-advantage/reboot_cmds.py"

Environment

• VMware NSX

• NSX Edge Appliances

Cause

• This is a known cosmetic issue. The NSX File Integrity Checker continuously monitors system files against a baseline that is established during the initial installation or the latest upgrade.
• Normal internal processes may occasionally modify or remove specific system files, such as /usr/lib/ubuntu-advantage/reboot_cmds.py. When this happens, it triggers a false positive warning. This does not impact the functionality or health of your NSX environment.

Resolution

To resolve these alerts and stop the excessive logging, you must create a new file integrity baseline on your NSX Edges. It is recommended to perform these steps on all Edges in the cluster to ensure consistent logging across your environment.

1. Log in to each affected Edge appliance as the root user via SSH.

2. Execute the following command to establish a new baseline (please note this may take a few minutes):

   /opt/vmware/integrity-checker/bin/integrity_checker.py -f baseline
   

3. Once the baseline generation is complete, you can verify that the status has returned to "OK" by running:

   /opt/vmware/integrity-checker/bin/integrity_checker.py -f check
   

4. You can also monitor the integrity checker log to confirm the operational status:

   tail -n 5 /var/log/vmware/integrity_checker.log

Additional Information

For more details regarding the file integrity checker and post-upgrade alerts, please refer to the following resources:

• Manager logs spammed with FILE_INTEGRITY_CHECK_FAILED

• After NSX upgrade Manager logs spammed with FILE_INTEGRITY_CHECK_FAILED