Generating a support bundle from vCenter Server takes a very long time

Products

• VMware vCenter Server

Issue/Introduction

• “Generate Support Bundle” in VAMI gets stuck at 20% progress and it finally completes several hours later.
  
  
• vc-support command displays warnings similar to:
  
  YYYY-MM-DD HH:MM:SS,### WARNING authzData.py:116 Failed to find principal: <AD user account>
Traceback (most recent call last):
  File "/usr/lib/vmware/site-packages/supportbundle/authzData.py", line 112, in _fetch_users
    principal = _get_principal(name, isGroup)
  File "/usr/lib/vmware/site-packages/supportbundle/authzData.py", line 140, in _get_principal
    sso_sic.principalDiscoveryService.FindUsersInGroup(
  File "/usr/lib/vmware/site-packages/pyVmomi/VmomiSupport.py", line 618, in <lambda>
    self.f(*(self.args + (obj,) + args), **kwargs)
  File "/usr/lib/vmware/site-packages/pyVmomi/VmomiSupport.py", line 391, in _InvokeMethod
    return self._stub.InvokeMethod(self, info, args)
  File "/usr/lib/vmware/site-packages/pyVmomi/SoapAdapter.py", line 1796, in InvokeMethod
    raise obj
pyVmomi.VmomiSupport.sso.fault.InternalFault: (sso.fault.InternalFault) {
   dynamicType = <unset>,
   dynamicProperty = (vmodl.DynamicProperty) [],
   msg = "Idm client exception: Can't contact LDAP server",
   faultCause = <unset>,
   faultMessage = (vmodl.LocalizableMessage) []

Note: "WARNING authzData.py:116 Failed to find principal: VSPHERE.LOCAL\WorkloadStorage" can be ignored.

• There is sufficient free disk space on the VCSA

Environment

vCenter Server 8.0

Cause

When generating a support bundle, vCenter Server attempts to collect authorization data, which includes mapping vCenter permissions to users and groups. To do this accurately, it must resolve the "Principals" (users/groups) defined in the Identity Sources.

If an Active Directory identity source has been configured, vc-support calls the Identity Management (IDM) service to find these users. The "Can't contact LDAP server" error indicates that the vCenter's IDM service cannot reach the Domain Controllers over the LDAP/LDAPS ports (389/636).

The support bundle collection process is sequential. If the error occurs for each AD users, the entire bundle generation remains stuck at that stage—which frequently happens around the 20% mark.

Resolution

Fix the connectivity or temporarily remove the unreachable Identity Source if it's no longer used.

To check Identity Source Health and test connectivity:

• Verify if you can log in to vCenter with an AD account or browse AD users in the vSphere Client (Administration > Single Sign-On > Users and Groups). If this is also failing or slow, the issue is with the vCenter-to-AD connectivity.
  
  
• From the vCenter SSH command line:
  
  Test if the ports are open to the Domain Controller 
  curl -v telnet://<DC_IP_OR_FQDN>:636
  
  Verify the validity of the LDAPS/LDAP certificate
openssl s_client -connect <DC_IP_OR_FQDN>:636 -showcerts
  
  (Substitute 389 if using standard LDAP)
  
  /opt/vmware/bin/sso-config.sh -get_identity_sources

If the certificate is expired, renew it.