Tune vSphere HA Host Isolation and VM Monitoring to Prevent False Restarts

Desired Outcome

Adjust vSphere HA host isolation response and VM monitoring settings so that brief network blips or slow storage responses do not cause HA to restart virtual machines unnecessarily. The cluster remains protected against real host failures while reducing false positive restarts.

Prerequisites

• vCenter Server managing the target cluster
• Cluster with vSphere HA already enabled
• Administrator privileges on vCenter
• VMware Tools installed on VMs that will use application monitoring
• Known stable IP addresses for isolation addresses, such as default gateways or DNS servers

Procedure

1. Review current HA settings

   In vCenter, select the cluster, then go to Configure > vSphere Availability. Note the current Host Isolation Response, VM Monitoring level, and any configured isolation addresses.

2. Add reliable isolation addresses

   Under Host Isolation Response, edit Isolation Addresses. Add at least two addresses that are reachable when the management network is healthy, such as the default gateway and an external DNS server. Avoid addresses on the same failed switch as the management network.

3. Set host isolation response

   Choose one of the following based on application tolerance:

   • Power Off VMs: HA powers off VMs on an isolated host and restarts them elsewhere. Use when data consistency matters more than brief downtime.
   • Shutdown VMs: Attempts guest shutdown before power off. Requires VMware Tools.
   • Leave Powered On: VMs remain running if the host is isolated but still operational. Use only if shared storage remains accessible and network partition is brief.

4. Configure VM monitoring

   Under VM Monitoring, select VM and Application Monitoring only for VMs with VMware Tools running. Set VM Monitoring to Enabled for critical workloads and Disabled for workloads that tolerate restarts poorly.

5. Adjust VM restart priority

   In VM Protection, set Restart Priority to Highest, High, Medium, or Low per VM. Critical infrastructure VMs should use Highest or High.

Expected Checks

• Cluster summary shows HA enabled with no configuration errors
• Isolation addresses respond to ping from each host management interface
• VMware Tools status shows Running for monitored VMs
• HA advanced option das.isolationaddress list contains the intended addresses

Verification Procedure

1. Confirm isolation address reachability

   Run the following from an ESXi host shell with root privileges, replacing 10.0.1.1 with an isolation address:

   esxcli network ip ipv4 interface list
   esxcli network ip connection list | grep 10.0.1.1

   Expected: the address is reachable and no packet loss occurs during normal operation.

2. Simulate management network isolation

   Disable the management vmknic on one host temporarily. HA should mark the host as isolated after the configured delay and apply the selected isolation response. Re-enable the adapter and confirm the host rejoins the cluster.

   Risk: VMs may be powered off or restarted during this test. Schedule during a maintenance window.

3. Review HA logs

   Check /var/log/vmware/hostd.log on the host for isolation and restart events. Look for messages referencing das.isolation or ha-event.

Recovery Options

• Host remains isolated after network restore: Restart hostd or reboot the host, then confirm it rejoins the cluster in vCenter.
• Unnecessary restarts occur: Revert Host Isolation Response to Leave Powered On temporarily, remove unreliable isolation addresses, and review VM monitoring sensitivity.
• Insufficient capacity after restarts: Move non-critical VMs to another cluster or disable Admission Control temporarily until capacity is restored.

Limitations

• HA does not detect application hangs unless VM and Application Monitoring is enabled and VMware Tools is healthy.
• Isolation addresses that share a physical switch with management traffic can cause false positives during switch failures.
• Changing isolation response affects all VMs in the cluster unless per-VM overrides are configured.