Error: Logical Switch State FAILED alert in Aria Operations for NSX segments

Products

• VMware NSX
• VMware Aria Operations (formerly vRealize Operations) 8.x
• VMware Cloud Foundation

Issue/Introduction

• Aria Operations (formerly vRealize Operations) reports a critical alarm: Summary|Logical Switch State "FAILED" = "FAILED".

         

• In the NSX Manager UI under Networking > Segments, all segments show a status of Success.
• When checking the NSX API (GET https://<nsx-manager-fqdn>/api/v1/infra/segments/<segment-name>/state) or Corfu database (/opt/vmware/bin/corfu_tool_runner.py -o showTable -n nsx -t LogicalSwitchState), specific segments report a state of "in_progress" or "CONFIG_STATUS_IN_PROGRESS".
• Canceling the alert in Aria Operations results in the alert re-triggering immediately.
• Reboot of NSX Manager nodes did not resolve the issue.

Environment

• VMware NSX 4.x, 9.x
• VMware Aria Operations 8.x, 9.x
• VMware Cloud Foundation (VCF)

Cause

Aria Operations collects logical switch states via the NSX API. If the backend API reports a segment is not in a fully realized/success state (such as in_progress), Aria Operations interprets this as a failure and triggers an alert. This typically occurs when a backend task fails to update the Corfu database state after a network event (e.g., a core switch failure).

Resolution

This will be fix in future release.

As a workaround, follow the below steps:

1. Download the attached script fix_dvpg_lsstate_stuck_in_progress.py
2. Copy to any one of NSX manager node under /tmp

3. List the affected LogicalSwitches using command
   python3 ./fix_dvpg_lsstate_stuck_in_progress.py --read_only

    

4. Fix the affected LogicalSwitches using command 
   python3 ./fix_dvpg_lsstate_stuck_in_progress.py --cleanup

    

5. Confirm no more matches from the list again using 
   python3 ./fix_dvpg_lsstate_stuck_in_progress.py --read_only

Notes: 

• Requires /opt/vmware/bin/corfu_tool_runner.py on the NSX Manager.
• Always run --read_only first to confirm the affected LogicalSwitch Id(s) before --cleanup.
• Safe to re-run: once a record is CONFIG_STATUS_SUCCESS it no longer matches and is skipped.
• Creating new DV Portgroups in the environment will result in "in_progress" state and the need to run the checks again with the script is required.