/storage/core 100% usage with core.snmpd.xxxxx files

[Job8516]

I have just upgraded VCenter and ESXi servers from 7.0u3 to 8.0u1 and have come across the above problem.

SNMP services are disabled on esxi servers, and no receiver is configured on VCenter.

The core.snmpd.xxxxx files are all 29MB each and filling the disk. I am obviously having to delete them to keep VCenter healthy.

Does anyone have any ideas what is going on and how to stop these files from being created?

[mannharry]

hello

can we perform the restart of the vCenter appliance and validate
Did the SNMP service logs keep growing after disabling the option and restarting the services?

Regards

Harry

[Job8516]

Hi Harry,

I had already tried restarting just the vCenter appliance. I have now restarted both vCenter and ESXi servers.

Unfortunately, the problem continues.

All ESXi servers have SNMP services disabled. vCenter does not have any listeners configured. Are there any specific logs that i should be checking to narrow down the possible cause?

Sorry, I am at a bit of a loss on this one.

Many thanks.

[Job8516]

Just upgraded to 8.0.1.00100 but problem persists.

If anyone has any ideas I would be grateful.

[mannharry]

Guess you need to log an SR.

Regards

Harry

[Sergey_77777]

I am observing the same problem, if you find solutions, please email me, I will be grateful.

I performed diagnostics using the vSphere Diagnostic tool utility, the utility issues a warning [FAIL] ***.domain.local: the reverse DNS lookup could not be performed! Details: Reverse lookup: "IP DC" could not be resolved.

Although the forward and reverse zones on DC are spelled out correctly, I don't understand what kind of bug

[Job8516]

I ran VDT too. The only issues it highlighted were the core files and NTP configuration. I corrected the NTP configuration (there wasn't an issue, I was just syncing the time from the host) to use an NTP server, deleted the core.snmpd.xxxxx files. Reran VDT and no issues highlighted at all.

core.snmpd.xxxxx files are still being created every minute 😞

If you find any answers I would also be very grateful.

[Ajay1988 · Accepted solution]

Do cehck if you guys have similar logging on VC:

/var/log/vmware/messages
xxxxxxxxxxxxxxx:19.442724+02:00 vcsa snmpd[88617]: P3 5: load_entmib: fetch_sysinfo failed, no entPhysicalTable entry
xxxxxxxxxxxxxxx:19.442795+02:00 vcsa snmpd[88617]: P4 6: serial number longer than rfc 4133 allows, truncating
xxxxxxxxxxxxxxx:19.680396+02:00 vcsa systemd[1]: snmpd.service: Main process exited, code=dumped, status=11/SEGV
xxxxxxxxxxxxxxx:19.695691+02:00 vcsa vmware-snmpd: INFO: firewall close port 161 command result rc=0
xxxxxxxxxxxxxxx:19.712997+02:00 vcsa systemd[1]: snmpd.service: Failed with result 'core-dump'.
xxxxxxxxxxxxxxx:25.599393+02:00 vcsa systemd[1]: Stopped VMware SNMP Server Daemon.

If yes; then this is known bug and should get resolved soon. ETA would be Aug/Sept 2023.

Only workaround is to clean those dump files or disable snmpd service.
Stop SNMPD service:
systemctl stop snmpd

Disable SNMPD at start up with the following command:
systemctl disable snmpd

[Job8516]

@Ajay1988 Many thanks. SNMPD service disabled, core files deleted. All looking good so far.

[TimVWC]

I installed 8.0.1.00300 and it seems to have fixed this issue