How to Capture a Memory Dump from a Provisioned Target in VMware Environment
Article ID: CTX125086
Updated On:
Description
This article outlines the process to generate a memory dump file from a provisioned target device in a VMware environment, then using vmss2core tool convert snapshot to .dmp file, which can be analyzed in windbg.
This is a three-step process of which neither steps require any modification to the virtual machine.
Instructions
Prerequisites:
Obtain vmss2core
Please refer https://kb.vmware.com/s/article/2003941
Retrieve files vmss2core.exe and zlib1.dll from VMware workstation installation folder
C:\Program Files (x86)\VMware\VMware Workstation
or
C:\Program Files\VMware\VMware Workstation\
Note: If vmss2core is not available in these install directories, it can be downloaded. Download location is available in https://archive.org/download/flings.vmware.com/Flings/Vmss2core/
Change Disk Mode to Exclude Virtual Disks from Snapshots in the vSphere Client.
Required privileges:
- Virtual machine > State > Remove Snapshot
- Virtual machine > Configuration > Modify device settings
- Virtual machine > Configuration > Extend virtual disk
- Power off the virtual machine and delete any existing snapshots before you change the disk mode. Deleting a snapshot involves committing the existing data on the snapshot disk to the parent disk.
- Select Inventory > Virtual Machine > Edit Settings.
- Click the Hardware tab and select the hard disk to exclude.
- Under Mode, select Independent > Persistent.
Complete the following procedure to capture memory dump:
-
After the provisioned target virtual machine is in an unresponsive state, proceed to suspend the virtual machine.
Note: Suspending a virtual machine writes the state to a file with a .vmss extension. By default, the .vmss file is stored in the directory in which the virtual machine configuration files (.vmx) are stored. -
Copy the .vmss file from the datastore to a local disk.
The size of the .vmss file is equivalent to the total memory assigned to the virtual machine.Note: If uploading the file to Citrix Insight Services (CIS) make sure to zip the file beforehand.
The utility to convert the file from .vmss file to a dump file format is located in the <Program Files>\VMware\VMware Workstation folder on the device that VMware workstation 7 is installed.
- Run the following command to begin the conversion process:
vmss2core –W filename.vmss
Note: Command is case sensitive.
Example:
vmss2core –W8 filename.vmss
If not you will get the error message:
"Error Parsing Windows data
Cannot create memory dump"
Note: If there is a .vmem file with the same date and time as the .vmss, then retrieve both. For example, a Blue Screen error generates the two files and both must be passed as parameters.
Executing vmss2core lists the following optional parameters:
| -q | Quiet(er) operation |
| -M | Create core file with physical memory view (vmss.core). |
| -l str | Offset stringset expressed as 0xHEXNUM,0xHEXNUM,... . |
| -N | Red Hat crash core file for arbitrary Linux version described by the "-l" option (vmss.core). |
| -N4 | Red Hat crash core file for Linux 2.4 (vmss.core). |
| -N6 | Red Hat crash core file for Linux 2.6 (vmss.core). |
| -P | Print list of processes in Linux VM. |
| -P<pid> | Create core file for Linux process <pid> (core.<pid>). |
| -W | Create WinDbg file (memory.dmp) with commonly used build numbers ("2195" for Win32, "6000" for Win64). |
| -W<num> | Create WinDbg file (memory.dmp), with <num> as the build number (for example: "-W2600"). |
| -WDDB<num> | Create WinDbg file (memory.dmp), with <num> as the debugger data block address in hex (for example: "-W12ac34de"). |
| -WSCAN | Create WinDbg file (memory.dmp) and scan all of memory for the debugger data block (instead of just low 256 MB). |
For Mac OS guests: -X32-0 for Darwin Kernel Version 9.0.0: Tue Oct 9 21:35:55 PDT 2007 | |
VMware Documentation
Converting a snapshot file to memory dump using the vmss2core tool (2003941)
Environment
Issue/Introduction
