OPERATIONAL DEFECT DATABASE
...
...
Every hour, a number of ESXi Firewall Rule configuration change events are observed on all hosts in vSAN Clusters: Firewall configuration has changed. Operation 'enable' for rule set 'esxupdate' succeeded.Firewall configuration has changed. Operation 'disable' for rule set 'esxupdate' succeeded. You also notice VUM scan events around the above Firewall changed events. Successfully scanned <ESXi FQDN> Messages in envoy.log might show the local http connection limit being hit due to connections to 127.0.0.1:8084 (8084, 9084, and 9087 are VUMs port) 2023-12-12T13:33:33.036Z warning envoy[3405621] [Originator@6876 sub=filter] [C11747] local https connections exceed max allowed: 20482023-12-15T13:33:33.036Z warning envoy[3405621] [Originator@6876 sub=filter] [C11747] closing connection TCP<127.0.0.1:41032, 127.0.0.1:8084> The user initiating the VUM scan is com.vmware.vsan.healthThe timing of these events varies with different clustersThe vSAN clusters have vSAN Health Service enabled with a scheduled check every 60 minutes
vSAN generates system baselines and baseline groups for use with vSphere Update Manager. You can use these recommended baselines to update software, patches, and extensions for hosts in your vSAN cluster. vSAN 6.6.1 and later generates automated build recommendations for vSAN clusters. vSAN combines information in the VMware Compatibility Guide and vSAN Release Catalog with information about the installed ESXi releases. These recommended updates provide the best available release to keep your hardware in a supported state. The vSAN Build Recommendation checks are initiated as part of the vSAN Health Check that is run every 60 mins (default configuration). See KB https://kb.vmware.com/s/article/58891 for details on this test.
This is an expected behavior based on the configuration of the vSAN Health Check in the affected vSAN cluster.If you wish to disable the VUM scans or reduce their frequency, check the Workaround section of this article.
Option 1: Reduce the frequency of VUM ScansFor e.g. to set the scans to happen weekly, do the below: SSH into the vCenter ApplianceEdit /etc/vmware-vsan-health/config.conf file using a text editor like 'vi'Under [VumIntegration] section add the below parameters (the values are in minutes, 10080=7 days) autoCheckerInterval = 10080 VumScanTaskIntervalInMin = 10080 Restart vSAN health service using this command /usr/lib/vmware-vmon/vmon-cli -r vsan-health Option 2: Disable vSAN Baseline VUM Scans completely Note: Build recommendation would not be provided in vSAN Health Service after making the changes below. SSH into the vCenter ApplianceEdit /etc/vmware-vsan-health/config.conf file using a text editor like 'vi'Under the parameter [KillSwitch], add the following field. Create one if [KillSwitch] section doesn't exist. [KillSwitch] VumIntegration = false Restart vSAN health service using this command /usr/lib/vmware-vmon/vmon-cli -r vsan-health
Click on a version to see all relevant bugs
VMware Integration
Learn more about where this data comes from
Bug Scrub Advisor
Streamline upgrades with automated vendor bug scrubs
BugZero Enterprise
Wish you caught this bug sooner? Get proactive today.
