This issue occurs when the VM’s guest OS entered a standby sleep state. The EPSec may lose communication with the vShield driver, resulting to "Anti-Malware Driver Offline" status in the DSM console.

1. Check the VM Status.
   1. Using VMware vSphere client, log in to vCenter.
   2. Check the affected virtual machines whether the machine is suspended or hibernated due to power management.
   3. Isolate the issue.

   

2. Make sure that the vShield drivers are installed. By default, VMware tools installation do not install vShield drivers. Perform installation using the "Complete" or "Customer" option and manually select this driver.

   

3. Check all your setup versions. Refer to the Deep Security and VMWare compatibility matrix.
4. Check if the VMware vShield Endpoint Thin Agent is running on the protected VM.
   1. Open the run dialog box in the virtual machine.
   2. Type the "msinfo32" command.
   3. Go to the Software Environment section > System Drivers > System Information applet.
   4. Make sure that the VM drivers, vmci and vsepflt, are running.

      

5. Make sure that the VM version is 7 or above.

   

6. Check the vShield License.

   

7. Check the ESXi networking. Go to the vSphere Client, select ESX > Configuration > Networking.

   

    

   Create vSwitch and port group after preparing ESX.
8. Check the appliance’s networking – vNIC. Go to the vSphere Client, select ESX > Configuration > Networking.

   

9. Check the value of Net.DVFilterBindIpAddress.
   1. Go to the vSphere client and select an ESX server.
   2. Navigate to Configuration > Advanced Settings > Net.
   3. Make sure that the Net.DVFilterBindIpAddress setting has a value of 169.254.1.1. If this is empty, enter the value and reboot the ESX server.
10. Update the certificates and check the connection.

    

11. Check the Deep Security Virtual Appliance (DSVA).
    1. Log on to DSVA via console or SSH.
    2. Execute the "ifconfig –a" command. The following should appear:

       

    3. Test the DSVA and ESX communication.
    4. From DSVA, ping the IP of vmservice-vmknic-pg (ex. 169.254.1.1). The AM process should listen to 48651. The TCP connection is established when protected VM is boot-up.

       

12. Check the EPSec Service configuration.
    1. Connect to the vCentre or to the affected host using vSphere Client.
    2. Go to Configuration > Software > Advanced Settings.
    3. Scroll to the bottom and select UserVars.

       

    4. Look for the UserVars.VshieldEndpointSolutionsConfiguration field and double-check if there are any duplicate settings. You may copy the content to a Notepad and easily find any duplicated settings.

       If there are duplicated settings, correct it and save the changes. If none, proceed to Step 13.

    5. Restart the vShield Endpoint Service on ESX/ESXi using the following command:

       ~ # /etc/init.d/vShield-Endpoint-Mux restart

       The following results will appear:

       vShield-Endpoint-Mux stopped
       vShield-Endpoint-Mux started

13. Check the vShield driver on ESXi.
    1. Log on to ESX via SSH.
    2. Execute the "ps |grep vShield-Endpoint-Mux" command. The following appears:

       

If the issue persists, collect the following and send to Trend Micro Technical Support:

• DSVA Diagnostic Package
• DSM Diagnostic Package
• Virtual Agent Diagnostic Package
• Copy of the /var/log/messages and /var/log/syslog logs inside the DSVA appliance
• ESXi version and build
• vShield Manager version and build
• Manually exported msinfo32 output as mentioned in Step 4