High CPU utilization on NSX Appliance 6.2.4

CaptainvOPs

I realize that writing up this blog post now, may be irrelevant considering most if not all VMware customers are well beyond NSX appliance 6.2.4.  But some folks may still find the information shared here still relevant.  At the very least the instructions for restarting the bluelane-manager service on the NSX appliance is still something handy to keep in your Rolodex of commands.

There’s an interesting bug in versions of the NSX appliance ranging from versions 6.2.4 – 6.2.8, where the utilization slowly climbs, eventually maxing out at 100% CPU utilization after few hours.  For my environment, we had vSphere version 6, and roughly 60 hosts that were also on ESXi 6.  We were also using traditional SAN storage on FCOE.  In this case a combination of IBM XIV, and INFINIDATs.  In most cases, we could just restart the NSX appliance, which would resolve the CPU utilization issue, however sometimes within two hours, the CPU utilization would climb back up to 100% again. When the appliance CPU maxed out, after a few seconds the NSX manager user interface would typically crash.

The Cause: (copied from KB2145934)

“This issue occurs when the PurgeTask process is not purging the proper amount of job tasks in the NSX database causing job entries to accumulate. When the number of job entries increase, the PurgeTask process attempts to purge these job entries resulting in higher CPU utilization which triggers (GC) Garbage Collection. The GC adds more CPU utilization.”

The only problem with the KB, is that our environment was currently on 6.2.4, so clearly the problem was not resolved.

In order to buy ourselves some time, without needing to restart the NSX appliance, we found that simply restarting a service on the NSX appliance called ‘bluelane-manger‘, had the same affect, but this was only a work around.

You can take the following steps to restart the bluelane-manager service:

 

  • SSH to the NSX Manager using the ‘admin’ account
  • Type
en
  • Type:
st en
  • When prompted for the password, type:
IAmOnThePhoneWithTechSupport
  • To get the status of the bluelane manager service type:
/etc/rc.d/init.d/bluelane-manager status
  • To restart the bluelane-manager service, type:
 /etc/rc.d/init.d/bluelane-manager restart

Now after a few seconds, you should notice that the NSX appliance user interface has restored to normal functionality, and you can log in, and validate that the CPU has fallen to normal usage.

What made the issue worse, was the fact that we had hosts going into the purple diagnostic screen.  I’m not talking one or two here.  Imagine having over 20 ESXi hosts drop at the same time, during production hours, and keep in mind that all of these hosts were running customer workloads….. If you’ll excuse the vulgarity, that certainly has a pucker factor exceeding 10.  At the time, I was working for a service provider running vCloud Director.  The customers were basically sharing the ESXi host resources.  We were also utilizing VMware’s Guest Introspection (GI) service, as we also had trend micro deployed, and as a result most customers were sitting in the default security group.

Through extensive troubleshooting with VMware developers, at a high level we determined the following:  Having all customer VMs in the default NSX security group, every time a customer VM powered on or off, was created or destroyed, vMotioned, replicated in or out of the environment, all had to be synced back to the NSX appliance, which then synced with the ESXi hosts.  Looking at the at specific logs on the ESXi hosts that only VMware had access to, we saw a backlog of sync instructions that the hosts would never have time to process, which was contributing to the NSX appliance CPU issue.  This was also causing the hosts to eventually purple screen.  Fun fact was that by restarting the hosts we could buy ourselves close to two weeks before the issue would reoccur, however, performing many simultaneous vMotions would also cause 100% CPU on the NSX appliance, which would put us into a bad state again.

Thankfully, VMware was currently working on a bug fix release at the time NSX 6.2.8, and our issue served to spur the development team along in finalizing the release, along with adding a few more bug fixes they had originally thought was resolved in the 6.2.4 release.

NSX 6.2.8 release notes

Most relevant to our issues that we faced were the following fixes:

  • Fixed Issue 1849037: NSX Manager API threads get exhausted when communication link with NSX Edge is broken
  • Fixed Issue 1704940: You may encounter the purple diagnostic screen on the ESXi host if the pCPU count exceeds 256
  • Fixed Issue 1760940: NSX Manager High CPU triggered by many simultaneous vMotion tasks
  • Fixed Issue 1813363: Multiple IP addresses on same vNIC causes delays in firewall publish operation
  • Fixed Issue 1798537: DFW controller process on ESXi (vsfwd) may run out of memory

Upgrading to NSX 6.2.8 release, and rethinking our security groups, brought stability back to our environment, although not all above issues were completely resolved as we later found out.  In short most “fixes” were really just process improvements under the hood.  Specifically we could still cause 100% CPU utilization on the NSX appliance by putting too many hosts into maintenance mode consecutively, however at the very least the CPU utilization was more likely able to recover on its own, without us needed to restart the service or appliance. Now why is that important you might ask?  Being a service provider, you want to quickly and efficiently roll through your hosts while doing upgrades, and having something like this inefficiency in the NSX code base, can drastically extend maintenance windows.  Unfortunately for us at the time, as VMware came out with the 6.2.8 maintenance patch after 6.3.x, so the fixes were also not apart of the 6.3.x release yet.  KB2150668

As stated above, the instructions for restarting the bluelane-manager service on the NSX appliance is still something that is very handy to have.

 

 

 

What does End of General Support mean?

captainvopsrd

What does End of General Support mean?

What does End of General Support mean?

On September 19th, vSphere 5.5 exited its general support phase and moved into something called “Technical Guidance”. In response to this, many have already moved to a newer release of the vSphere 6.x line. Whether it be for compatibility concerns or a reasonable wariness of touching what’s not broken, there are several of us who The post What does End of General Support mean? appeared first on VMware vSphere Blog .

VMware Social Media Advocacy

Introducing new VMware Cloud on AWS training…

captainvopsrd

Introducing new VMware Cloud on AWS training course

Introducing new VMware Cloud on AWS training…

A brand new 3-day training course has been released for VMware Cloud on AWS. Watch this lightboard illustration by one of our Senior Technical Instructors to understand more about what you’ll learn in the 3-day course. Find out more on http://www.vmware.com/education or read the course overview here.

VMware Social Media Advocacy

vSAN 6.7 – vSAN Management Today and in the Future

captainvopsrd

vSAN 6.7 – vSAN Management Today and in the Future

vSAN 6.7 – vSAN Management Today and in the Future

The momentum of technical innovation continues with the latest release of vSAN, the industry leading HCI solution. This session will provide a technical overview of what’s new in vSAN 6.7. Join Duncan Epping, Chief Technologist VMware EMEA to learn about the new features and functionality of vSAN 6, how this release delivers a more intuitive operating experience, a more consistent application experience, whilst offering a more holistic support experience for our customers.

VMware Social Media Advocacy

VMworld-US 2018 Thoughts, A Week Later

CaptainvOPs

A week ago, VMworld-US for 2018 wrapped up, and I have been slowly collecting my thoughts throughout the week to try and put out a meaningful blog post about my experience this year. While I was there I passed the VCP6.5-DCV delta exam. I’ve heard other people say the the delta exams are tougher, and they certainly were not wrong. Now I will be able to focus on getting the latest 6.5 VCAPs for the data center virtualization. I was also able to meet several other vExperts in the community, along with seeing old friends from years past. I was able to go out and celebrate with my new team at the end of the week which is always nice.

VMworld-US this year was a bit of a mixed bag, and it felt like it had lost its swagger. The half baked point system the events team dreamed up was just that. It certainly wasn’t thought out enough as only a few vendors participated. I guess you don’t know until you try, but hopefully it won’t make a return next year. If you did participate however, the swag that the VMworld team handed out was well worth it. The socks, laptop sleeve, and insolated bottle were all top notch. I was excited to get the VR headset, but disappointed that it doesn’t fit larger phones like the Nexus 6p. The solutions exchange was much more reserved compared to previous years. I am happy to see the continued support for those authors in the vCommunity, by encouraging book signings, and a meet and greet with the authors.

VMware did have some good announcements this year however. VMware ESXi 64-bit support on Arm processors, Amazon Relational Database service on VMware, and vSphere platinum to name a few. The keynotes themselves were great, but I much rather enjoyed last years opening act more, when VMware entertained the crowd with virtual reality. It felt more edgy and futuristic. This year it was rather slow, and they just seemed to jump right into the keynote.

The guest speaker on Wednesday’s keynote was Malala Yousafzai, who was there to speak about her own struggles in her home country Pakistan, and the attempt on her life because she shares the beliefs of the modern world, where women have equal opportunities, both in career and education. But with so many other women actually in the tech industry, and the push for getting younger girls interested in technology, was she really the best choice? I’m not discrediting the hardships she went through in her own country, but what was the point in bringing all of that to a technology conference? To me it felt a little weird having her interviewed by someone who’s home country of India, to this day, still allows the practice of marriage arrangements. Maybe I was the only one who cared to look at the finer details of the exchange. The additional security and screening to have Malala there, caused too much congestion for attendees to get in. Most ended up skipping out on going to main stage for the keynote. The event itself, felt like the popularity of the speaker, outweighed the value to attendees.

I’m still on the fence about the VMworld fest this year, and I’m certainly not alone according to this reddit thread. Royal machines put on a good show for the most part, but with retirees taking the stage, it wasn’t the best show unless you just wanted to re-live the 90’s.

Blink 182 and Fallout Boy of previous years I felt were far better venues and locations. On the other side of screen in the picture below was the main stage, which most people couldn’t get to, so this was their only viewing option. It looks packed, and certainly was at the beginning, but when I left halfway through the set, this side of the screen was almost cleared out. Maybe VMworld should have taken the picture at the end?

Screen Shot 2018-09-09 at 12.34.48 PM

VMworld events team still failed at organizing enough food for attendees again this year, and lines were ridiculously long for the food and beer that was available. I’ve heard unconfirmed reports of attendees leaving hungry again. The location itself was awkward, and didn’t provide adequate room for the main show. The decor was cool, but that’s about it.

VMworld finally provided hot breakfast to the US crowd this year for attendees, which was much appreciated. I personally love bacon and eggs for breakfast, just not every single day. Would it have really cost that much more to provide some hot oatmeal, waffles or pancakes one or two days out of the week to break it up a bit?

There still seems to be a big push for moving to the cloud, and that certainly was the message that was being echoed at VMworld. Being a vExpert, and a member of the vCommunity, I was able to talk to many at the conference, and I was hearing a different message. The cloud is too expensive, and organizations have begun migrating away from the cloud, to have control of their infrastructure, and to keep costs down. Working for two very different cloud providers in my IT career, my current employer, who gives customers their own private clouds, and my former employer, who uses the shared cloud approach, certainly gives me an interesting perspective on cloud provider technologies and architecture. The market has many different cloud offerings for customers to chose from, but customers still have yet to fully understand what they need to be successful in the cloud, given their size and expectations. But who will lead them down the correct path? Perhaps we are on the cusp of another industry shift.