Alarm: "node_user_account_http_status_locked" for NSX service accounts recurs periodically in VCF Operations 9.1.x

Products

• VCF Operations
• VMware NSX

Issue/Introduction

In VCF Operations 9.1.x, rotating the NSX service account password temporarily clears the alarm, but the alarm recurs after a few days.

The following alert details appear in VCF Operations:

NSX alarm node_user_account_http_status_locked: Node local user account with username `[NSX_service_account]` is temporarily locked for VCF Networking web access, due to 5 failed authentication attempts were made over this account in last 900 seconds. Account will be locked for 900 seconds, during this any attempt to authenticate user `[NSX_service_account]` for UI or API access will be denied, due to lockout policy is in effect on the target user account. After 900 seconds account will be automatically unlocked and user `[NSX_service_account]` will again be allowed to web access VCF Networking via UI or API.

Environment

• VCF Operations 9.1.x
• NSX 9.1.x

Cause

Account lockouts recur when integrated services or automated inventory tasks attempt authentication using stale or un-synchronized [NSX_service_account] credentials following a password rotation.

Resolution

To resolve the account lockout and update credentials in SDDC Manager, perform the steps in The credentials were incorrect or the account specified has been locked - when performing a password update or remediate task for SDDC/NSX-T in SDDC Manager.

Additional Information

For related information and scenario-specific troubleshooting, see:

• The Synchronize Inventory Versions for NSX task fails in VCF Operations 9.1.1
• NSX service account disconnected and password rotation failure in SDDC Manager