Operating System Corruption due to snapshot consolidation

There are some cases where due to VMware snapshot consolidation the VM disk systems get corrupted. I faced with the same issue on ESXi 6.5 environment. I researched on the issue and finally found out that this is a known issue on some VMWare versions. The symptoms are as follows;

Symptoms:

  • Applications such as databases may report block-level data inconsistency.
  • Guest operating systems may report file system metadata inconsistencies
  • The VM fails to boot when it is running from an SEsparse snapshot. (SEsparse is a snapshot format introduced in vSphere 5.5 for large disks, and is the preferred format for all snapshots in vSphere 6.5 and above with VMFS-6)

Affected Environments:

VMFS-5 or NFS Datastores: VMs with virtual disks >2TB and snapshots. On VMFS-5 and NFS, the SEsparse format is used for virtual disks that are 2 TB or larger
VMFS-6 Datastores: VMs with snapshots. SEsparse is the default format for all snapshots on VMFS-6 datastores.

Impacted vSphere releases: vSphere 6.5 and above with VMFS-6 and any VM with snapshots | vSphere 5.5 and above when VMs with virtual disks >2TB have snapshots.

So basically if the VM size is more than 2TB in size and the VMFS versions are VMFS5 & VMFS6, there might be data corruptions on the infrastructure.

The issue has been resolved starting from the following ESXi versions;

  • vSphere 6.7 Update 1 
  • vSphere 6.5 Patch
  • vSphere 6.0 Patch

As a workaround, disabling “IO coalescing” for SEsparse can be carried out on host system level.

for more information, please refer the KB https://kb.vmware.com/s/article/59216

[source: VMware Knowledge Base]

Creating a vRealize Log Insight Content Pack

vRealize Log Insight delivers automated log management through aggregation, analytics and search, enabling operational intelligence and enterprise-wide visibility in dynamic hybrid cloud environments. Content Packs are plugins that provide pre-defined knowledge about specific types of events such as log messages. A content pack is made up of information that can be saved from either the Dashboards or Interactive Analytics pages.

Creating a vRLI content pack is relatively easy, but it may not be obvious to the casual vRLI user. Here’s how to create a content pack from vRLI objects that you have created so you can use them in a different vRLI environment.

Content packs provide an effortless way to transfer or share vRLI objects from one system to another, allowing you to reuse vRLI objects on multiple vRLI systems.

Creating and Exporting Content Packs

After creating your vRLI objects, select Content Packs, located on the main vRLI drop-down menu

On the Content Pack page, select My Content from the menu in the left pane, then select the Settings (gear) icon to the right of My Content in the center pane. The settings icon will only appear after pointing to it. From the settings drop-down menu, select Export.

After the Export Content Pack pop-up window appears, select which objects you would like to have in your content pack on the left pane, then create a name for the content pack as well as fill out additional information on the right pane. Finally, select EXPORT. This will save a .vlcp file to your local system.

Importing a Content Pack

You can import the .vlcp file you created into another vRLI instance by transferring the vlcp file to the system you will be accessing the vRLI instance from, and then going to the Content Pack page. Selecting IMPORT CONTENT PACK at the bottom of the left pane activates up a pop-up window which allows you to import your content pack by selecting the .vlcp file saved to your local system.

[source: https://code.vmware.com/web/loginsight]