When simultaneously doing vMotion of multiple virtual machines (VMs) protected by Deep Security Virtual Appliance (DSVA), some of the VMs may show "Anti-Malware Engine Offline", "Firewall Engine Offline", or "Intrusion Prevention Engine Offline" after moving to the new host.
The issue can be reproduced by doing a simultaneous vMotion of multiple DSVA-protected VMs. This happens because Deep Security Manager (DSM) has already checked the status of the VMs during heartbeat before the actual completion of vMotion process.
Waiting for the next heartbeat, which is 10 minutes by default, will fix the offline status.
As a workaround:
- Right-click the affected virtual machine.
- Select Actions and click Clear Warnings/Errors.
- Click Actions again and click Check Status.