Health Check "Data Protection - General - Immutable Protection Group Temporary Unlock Detection"
search cancel

Health Check "Data Protection - General - Immutable Protection Group Temporary Unlock Detection"

book

Article ID: 450962

calendar_today

Updated On:

Products

VMware Live Recovery

Issue/Introduction

This article explains the purpose and details of the Immutable Protection Group Temporary Unlock Detection health check and provides details on why it will report warnings or errors.

Environment

  • VMware Cloud Foundation 9.1 and above
  • VMware Live Recovery 9.1 and above

Resolution

What does the 'Immutable Protection Group Temporary Unlock Detection' Health Check do?

  • This health check monitors protection groups with immutability mode enabled. If a protection group enters a temporary unlocked state, a warning alert is generated. When the protection group remains unlocked for more than 24 hours, an error alert is generated.
  • The health check helps ensure that immutable protection groups maintain their security posture and are not left in an unlocked state for extended periods, which could pose a security risk.

What does it mean when it is in a warning (yellow) state?

  • A warning state indicates that an immutable protection group has been temporarily unlocked. This is typically done for administrative purposes such as:
    1. Modifying protection group configuration
    2. Performing maintenance operations
    3. Making changes to protected VMs
    4. The warning serves as a reminder that the protection group is currently in an unlocked state and should be locked again as soon as the administrative task is complete.

What does it mean when it is in an error (red) state?

  • An error state indicates that an immutable protection group has remained in a temporary unlocked state for more than 24 hours. This represents a potential security risk, as:
    1. Snapshots may be vulnerable to modification or deletion
    2. The protection group is not providing the expected immutability guarantees
    3. There may be a forgotten or incomplete administrative operation
    4. This requires immediate attention to restore the protection group to its locked state.

How do I resolve a temporary unlock alert?

  • To resolve the alert, you need to lock the protection group again:
    1. Lock the protection group using the Lock operation (require Broadcom support assistance).
    2. Navigate to the protection group in the vSAN Data Protection interface
    3. Verify that any administrative unlock tasks are complete
    4. The health check will automatically clear the alert once the protection group is locked

If the unlock was not authorized, contact Broadcom Support for assistance.

What information is displayed in the health check results?

  • The health check displays the following information:
ColumnDescription
Protection GroupThe name of the immutable protection group that is temporarily unlocked
TimeThe timestamp when the temporary unlock operation was performed

Can I view historical unlock events?

  • Yes, you can view historical temporary unlock events by clicking "VIEW HISTORY DETAILS" in the health check interface. This provides an audit trail of all temporary unlock operations performed on immutable protection groups.

What is the difference between temporary unlock and permanent unlock?

  1. Temporary unlock: Allows temporary modifications to an immutable protection group while maintaining its immutable status. The protection group can be locked again after administrative tasks are complete. This operation is tracked by this health check.
  2. Permanent unlock: Converts an immutable protection group to a regular protection group, removing immutability permanently. This is tracked by a separate health check: "Immutable Protection Group Permanent Unlock Detection".

Why is immutability important for protection groups?

  • Immutable protection groups provide ransomware protection by ensuring that snapshots cannot be modified or deleted, even by administrators. This is critical for:
    1. Cyber Recovery: Ensuring clean recovery points exist after a ransomware attack
    2. Compliance: Meeting regulatory requirements for data retention
    3. Data Integrity: Preventing accidental or malicious deletion of backup data

Leaving an immutable protection group in an unlocked state defeats these protections.

Warning State - Temporary Unlock Detected

  • The health check shows a warning (yellow) state when an immutable protection group is temporarily unlocked:

Error State - Unlock Duration Exceeds 24 Hours

  • The health check shows an error (red) state when the temporary unlock has persisted for more than 24 hours.

Health Check Details Table

  • The details table shows which protection groups are temporarily unlocked.

History Details View

  • The history details show all temporary unlock events over time.

 

Additional Information

Health Check Category & ID

Category: General
Health Check ID: com.vmware.vsan.health.test.immutablepghealth

Powered by Wolken Software