Run the esxcli storage nfs list command.

Use vCenter Datastore Performance view to monitor NFS datastore latency, IOPS and throughput.

Create a vCenter performance alarm for “Datastore Latency (NFS)” to trigger when thresholds are exceeded.

The correct monitoring workflow is to verify NFS datastore presentation at the host layer, then use vCenter performance views and alarms for operational monitoring. The esxcli storage nfs list command confirms that the NFS datastore is mounted and visible to the ESX host, which is the first validation point before any performance assessment. vCenter Datastore Performance views provide the correct datastore-level telemetry for latency, IOPS, and throughput, including NFS-backed datastores. Creating a vCenter performance alarm for NFS datastore latency allows proactive alerting when the datastore exceeds the required latency threshold. The esxcli storage core device list command is intended for block storage devices and paths, not NFS datastores. The --verbose NFS option listed here is not the required method for collecting detailed performance metrics in this scenario. VCF Operations Logs is log-focused, not the correct graph source for NFS throughput validation. vSAN Performance Service applies to vSAN performance, not external NFS datastore monitoring. Reference topics: NFS Datastore Monitoring, vCenter Datastore Performance, NFS Host Validation, vCenter Performance Alarms.

Cross-cluster capacity sharing, also known as vSAN datastore sharing or HCI Mesh, allows vSAN HCI clusters or vSAN storage clusters to share remote datastores with other vSAN HCI clusters or vSAN compute clusters. A required availability setting is to configure vSphere HA failure response for “Datastore with APD” on the client cluster to “Power off and restart VMs.” This ensures that if a remote vSAN datastore becomes unavailable to a host, vSphere HA can respond appropriately and restart affected virtual machines on hosts that can access the datastore. The latency option is incorrect because vSAN storage cluster guidance requires latency below five milliseconds between client and server ESX hosts, not a minimum of ten milliseconds. The VM object placement option is also incorrect because all objects that make up a VM must reside on the same datastore, not multiple datastores. Finally, client and server clusters must use compatible vSAN architectures; vSAN OSA and vSAN ESA cannot share datastores with each other. Reference topics: Cross-Cluster Capacity Sharing, vSAN Datastore Sharing, HCI Mesh, vSphere HA APD Response, vSAN OSA/ESA Compatibility.

The failure is host-specific because the KMS is online and reachable from the other hosts, and those hosts remain healthy with encryption enabled. In vSAN Data-at-Rest Encryption, vCenter works with the external KMS to manage the Key Encryption Key (KEK). ESX hosts use the KEK to unlock the Data Encryption Keys that protect encrypted vSAN disk data. When a host reboots, it must retrieve the required encryption key before encrypted vSAN disk groups can be mounted. If the host’s trust relationship, certificate, or KMS identity relationship is invalid or missing, that host cannot retrieve the key, and its encrypted disk groups remain unmounted. A Deep Rekey changes encryption material but does not repair a broken host-to-KMS trust relationship. Restarting vCenter is not the required fix because other hosts are functioning normally. TPM failure is not the best explanation because the error explicitly states that retrieval from the KMS failed. Reference topics: vSAN Data-at-Rest Encryption, External KMS Trust, Key Retrieval, Encrypted Disk Group Mounting.