High volume of vCenter login/logout events caused by Avi Controller

Products

• VMware vCenter Server

Issue/Introduction

• vCenter Server logs a high volume of UserLoginSessionEvent and UserLogoutSessionEvent (potentially hundreds per second).
• Aria Operations for Logs (formerly vRealize Log Insight) receives an excessive stream of logs, often via port 514/1514.
• Network infrastructure, such as firewalls, may experience high CPU or memory utilization due to the volume of syslog traffic.
• vCenter Server /storage/seat partition may fill up rapidly due to event database growth.

Environment

• Product: VMware vCenter Server 7.x, 8.x, 9.x
• Integrated Product: VMware Avi Load Balancer

Cause

This issue occurs when the Avi Controller excessively polls the vCenter Server API for inventory discovery. The most common root cause is a duplicate or unused Cloud configuration within the Avi Controller.

If multiple "vCenter Clouds" are configured for the same vCenter FQDN using the same service account, each cloud instance independently initiates its own polling cycle. This results in a massive number of login and logout operations.

Resolution

To resolve this issue, you must identify and remove the redundant polling source within the Avi Controller. Engage the AVI/NSX Support for any assistance to validate and perform the remediation.

Step 1: Identify the source of logins in vCenter

1. Log in to the vSphere Client.
2. Navigate to Monitor > Tasks and Events > Events.
3. Search for UserLoginSessionEvent.
4. Note the Source IP address and the User Name associated with the high-frequency logins.
5. Confirm that the IP address belongs to an Avi Controller or Service Engine.

Step 2: Cleanup Avi Cloud Configuration

1. Log in to the identified Avi Controller and perform the cleanup of redundant configuration. 
2. Engage the AVI/NSX Support for any assistance to validate and perform the remediation.

Step 3: Verification

1. Return to the vCenter Server Events console.
2. Monitor the rate of login/logout events. The volume should decrease significantly immediately after the redundant cloud is removed.
3. Monitor the syslog stream in Aria Operations for Logs to ensure traffic has stabilized.