Error: Admission check failed for memory resource dynamic heap VSI on ESXi 8.0 leading to network resets on Windows Server 2022

Products

• VMware NSX

Issue/Introduction

• Windows Server 2022 VMs experience intermittent connection resets (RDP, SQL, etc.)
• Resets occur at a periodic "minute mark" (e.g., every hour at :08).
• ESXi host /var/run/log/vmkernel.log contains errors similar to:
  WARNING: Heap: 3892: Could not allocate 8192 bytes for dynamic heap VSI.########. Request returned Admission check failed for memory resource

• Within the same /var/run/log/vmkernel.log file, we see ports in a blocked state:
  WARNING: Throttle.fc: FC_ForwardFastpathPktList:723: [nsx@6876 comp="nsx-esx" errorCode="ESX37"]Unable to resume traffic from port ######### :Out of slots

Environment

• VMware ESXi 8.0.x
• VMware NSX 4.x
• Guest OS: Windows Server 2022

Cause

• Environmental factors or physical switch incompatibility can cause the ESXi host's management memory pool (Cartel/VSI heap) to become exhausted.  This occurs due to the fact that when a switch drops packets or sends malformed headers, it gets logged by the ESXi host, which can be a problem when millions of these errors are observed, resulting in millions of log messages being written, potential filling up the Hosts' management memory pool (Cartel/VSI)
• When the host cannot allocate memory for management world processes, it fails to track NSX port states and session flows, leading to "Out of slots" errors and the subsequent dropping of TCP sessions.  

Resolution

1. Verify the heap exhaustion by checking vmkernel.log for "Admission check failed" messages.
2. Restart the management agents on the affected ESXi host: /sbin/services.sh restart
3. If the issue persists, migrate all VMs (vMotion) and reboot the ESXi host to fully clear the memory leak.
4. Ensure host BIOS and NIC drivers are up to date to prevent resource leaks from hardware agents.

Additional Information

• For instructions on retrieving logs, see How to retrieve NSX logs from ESXi hosts.
• Subscribe to this article to be updated on permanent fix status for the identified memory leak: How to subscribe to Knowledge Articles.