This is probably the strangest bug I've ever seen. We have noticed all of our OVF templates on our centralised NFS storage (which is mounted by our ESXi hosts) are being modified causing them to no longer match the checksums stored in the manifest file. I spent today analysing them and found the difference is just 8 bytes, the gdOffset value in the Hosted Sparse Extent Header, the full details of the format are here. Originally the value is set to 0xFFFF 0xFFFF 0xFFFF 0xFFFF but it's being changed to some other value. Within the same document it states that this is expected when a vmdk is stream-opitimized compressed (which it is) and that the real value is stored in the footer. Upon inspection the value of gdOffset in the footer is being copied into the header.
I can't figure out what's modifying them but it's happening at the same time for each vmdk. We've seen it occur twice last week, on a Monday and a Wednesday but not since. We've scrubbed all scheduled tasks and turned up nothing that ran at these times.
I could probably re-generate the checksums to get around the issue but it's really annoying me know and I'd really like to know what's causing it.
Thanks
