Edge NIC vmwNsxTDataCenterEdgeNICName receive ring buffer has overflowed by vmwNsxTDataCenterRxRingBufferOverflowPercentage% on Edge node vmwNsxTDataCenterEntityId. The missed packet count is vmwNsxTDataCenterRxMisses and processed packet count is vmwNsxTDataCenterRxProcessed. Action required: Run the NSX CLI command `get dataplane cpu stats` on the edge node and check: 1. If cpu usage is high, i.e., > 90%, then take a packet capture on the interface using the command `start capture interface <interface-name> direction input` or `start capture interface <interface-name> direction input core <core-id>` (to capture packets ingressing on specific core whose usage is high). Then analyze the capture to see if there are majority of fragmented packets or ipsec packets. If yes, then it is expected behavior. If not, datapath is probably busy with other operations. If this alarm lasts more than 2-3 minutes, contact VMware Support. 2. If cpu usage is not high, i.e., < 90%, then check if rx pps is high using the command `get dataplane cpu stats` (just to make sure the traffic rate is increasing). Then increase the ring size by 1024 using the command `set dataplane ring-size rx <ring-size>`. NOTE - The continuous increase of ring size by 1024 factor can lead to some performance issues. If even after increasing the ring size, the issue persists then it is an indication that edge needs a larger form factor deployment to accommodate the traffic. 3. If the alarm keeps on flapping i.e., triggers and resolves very soon, then it is due to bursty traffic. In this case check if rx pps as described above, if it is not high during the alarm active period then contact VMware Support. If pps is high it confirms bursty traffic. Consider suppressing the alarm. NOTE - There is no specific benchmark to decide what is regarded as a high pps value. It depends on infrastructure and type of traffic. The comparison can be made by noting down when alarm is inactive and when it is active.