When the ESXi host is not shut down properly, such as during a power failure, you see several instances of Event ID 771 and the following details in the system events of Deep Security:
Event: Contact by Unrecognized Client
Description: A connection to Deep Security Manager was initiated by a client not identifiable as a managed computer: x.x.x.x:49269. Either the client is not a managed Deep Security component, or a secure communication channel could not be established.
Based on the logs, it appears that the information of the virtual machines (VMs) is not synchronized between the VMware vCenter and the Deep Security Manager (DSM) server.
To resolve the issue, get the latest VM information from the vCenter to the Deep Security Manager:
- Remove the vCenter from the Deep Security Manager console.
- Reset the Deep Security Virtual Appliance (DSVA) from the vSphere console. This will clear the information in /var/opt/ds_agent/guests.
- Add the vCenter into the Deep Security Manager again.
- Activate all the VMs.