### Human: Can you tell about NCC Health Check: ofpfmfc_table_full_check. ### Assistant: NCC 3.9.0. The NCC health check ofpfmfc_table_full_check checks the number of rules configured in Open vSwitch (OVS) tables.. The NCC health check ofpfmfc_table_full_check​ checks the number of rules configured in Open vSwitch (OVS) tables and alerts if this number is approaching the limit.

For every NIC on every user VM, the acropolis service configures multiple rules inside Open vSwitch (OVS) tables.

If the number of configured rules is more than 80% of the limit, then a warning alert is generated.If the number of configured rules is more than 90% of the limit, then a critical alert is generated.

If the maximum number of rules is reached, then user VMs will not be able to communicate over the network.

This check only applies to Prism Element hosts.

Running the NCC Check

You can run this check as part of the complete NCC Health Checks:

nutanix@cvm$ ncc health_checks run_all

Or you can run this check individually:

nutanix@cvm$ ncc health_checks run_all

You can also run the checks from the Prism web console Health page: Select Actions > Run Checks. Select All checks and click Run.

This check is scheduled to run every hour, by default.

This check generates an alert after 1 failure and will self-resolve if the number of rules decreases below the threshold.

Sample output

For Status: PASS

nutanix@cvm$ ncc health_checks run_all

For Status: FAIL

nutanix@cvm$ ncc health_checks run_all

For Status: ERR

nutanix@cvm$ ncc health_checks run_all

Output messaging

Check ID200607DescriptionChecks that number of OVS rules is not reaching maximum number of rulesCauses of failureOpenFlow table is getting fullResolutionsConsider turning off unnecessary user VMs or remove unused vNICs from running user VMs on AHV host. For higher number of allowed OVS rules, ensure AOS version at least 5.10.5 and above on cluster.ImpactWhen number of OVS rules will reach maximum, some VMs may lose network connectivity.Alert IDA200607Alert TitleOpenflow Table Getting Full.Alert MessageNumber of OVS rules is num_flow_table_rules for bridge bridge_name on AHV host host_ip. This is more than usage_msg% of maximum allowed number of rules.. The "flow_table_limit" has been increased from 16k to 32k in AOS 5.20 which is bundled with AHV 20201105.2030. If you are running a lower version then consider upgrading AOS and AHV accordingly to avoid hitting the 16k limit in earlier versions.If you are already running AOS 5.20 and AHV 20201105.2030 or newer, and this check returns WARN or FAIL, consider powering off some user VMs or moving them to a different AHV host.

Scenarios that may trigger the flow table to fill up. There are currently 3 known Scenarios that may trigger the OpenFlow Table to have more entries than expected:

Broadcast storm or switching loop in the environment.Trunk port that is allowing all VLANs instead of only VLANs needed in the Nutanix environment.A Cisco ACI environment running in Application Centric Mode using "Flood in Bridge Domain" instead of "Flood in Encapsulation"
TroubleshootingRun the following commands on the AHV host with alerts. The counts from these commands will not be the same but they should be within a few hundred of each other.  First, collect a list of bridges configured in OVS:

root@AHV# ovs-vsctl list-br
Sample output:

root@AHV# ovs-vsctl list-br
 For each switch run the command:

root@AHV# ovs-vsctl list-br
Based on this output:

Does the number of flows from br.dmx come close to the total number of flows on br0.local + any other vswitch you may have? If "yes" you are most likely hitting a broadcast storm in your environment. Please work with your networking team to rule out a broadcast storm or loop within the NetworkIf br.dmx reports a number MUCH higher than br0.local + other vSwitches you are most likely hitting scenarios 2 or 3.
 If you are hitting Scenario 2 or 3 please do the following

Verify that VLANs are pruned to the host by adding a "switchport trunk allowed vlan" statement to the switch ports that only allows VLANs to the AHV host that are needed.If running ACI please engage Cisco to verify if running Flood in Encapsulation will work in your environment and use this instead of Flood in the Bridge domain.If neither of these resolves your issues please engage Nutanix Support to assist with increasing Openflow flow limits.
  

Known issues

The check may fail with the following error if bridge chaining is disabled:

root@AHV# ovs-vsctl list-br

This issue is resolved in:

AOS 5.15.X family (LTS): AOS 5.15.2AOS 5.18.X family (STS): AOS 5.18

Please upgrade AOS to versions specified above or newer.

It is not recommended to disable bridge chaining. Disabling bridge chaining should only be used for troubleshooting purposes and once troubleshooting is completed, bridge chaining should be re-enabled.

Run the following command on affected AHV hosts to re-enable bridge chaining:

root@AHV# ovs-vsctl list-br

Also restart acropolis on the same node to make sure the change is made aware to other nodes.

In case the above-mentioned steps do not resolve the issue, consider engaging Nutanix Support at https://portal.nutanix.com. ### Human: Now explain this as a Nutanix support agent summarizing the answer step by step. In case, you don't know the answer say - I don't know.