NSX Edge stops responding with /var/log partition at 100% disk usage

Products

• VMware NSX

Issue/Introduction

Symptoms:

• The NSX Edge crash or stops responding.
• The /var/log/ partition usage at 100% constantly.
• The BTMP.log file is bigger than usual and it is consuming most part of the /var/log partition.
• SSH is enabled on the Edge.
• Constant login attempts are logged in the btmp.log file.

Environment

VMware NSX for vSphere 6.2.x
VMware NSX for vSphere 6.4.x
VMware NSX for vSphere 6.3.x

Resolution

To prevent denial-of-service (DoS) attacks causing the BTMP.log log file filing the /var/log/ partition, please preform the one of the following.

1. Block SSH connectivity to the Edge Service Gateway from external IP addresses.
2. Disable SSH on Edge Services Gateways