How to convert a VMware virtual machine snapshot to a memory dump

book

Article ID: 181598

calendar_today

Updated On:

Products

Symantec Products Endpoint Protection

Issue/Introduction

 

Resolution

How to capture a memory dump from a VMware virtual machine without stopping its execution. This is useful in cases where customers do not want to force a crash or change Windows dump parameters and reboot the machine. This procedure can be done without interrupting the execution of the machine.

How to capture a memory dump from a VMware virtual machine

  1. When the VM hangs, crashes, or otherwise displays symptoms you are troubleshooting, then go into VMware vCenter, Workstation, or Fusion interface and take a snapshot. You may also choose to suspend the VM.
  2. Browse to the file location where the VM is located. This may vary depending on the VMware product you are using. Within VCenter, you can do this in VM properties by right clicking and browsing the datastore where the VM is located.
  3. Locate the folder with the same name as the VM.
  4. Inside the folder, locate the snapshot files. There will be a snapshot (.vmsn) or suspend file (.vmss) in the virtual machine directory, and a nonā€monolithic memory (.vmem) file, all with the same base name e.g. servername-Snapshot3 with different suffixes (vmsn, vmss, and/or vmem). If there are different snapshots, e.g. servername-Snapshot1, 2, 3, etc then locate the correct files for your recent snapshot or suspension by examining time/date stamps.
  5. Save a copy of all files that are present (.vmsn, .vmss, and .vmem) for your snapshot. In vCenter you can right click on the files and choose Download and save them to the local machine. Zip them up and send them to Symantec Support.

    The following steps are for your information only -- it is not necessary to perform them; Symantec support can convert the snapshot files themselves.
     
  6. Copy the vmss2core.exe utility to the same location as the snapshot files. See http://kb.vmware.com/kb/2003941 for instructions.

  7. Open a command line and navigate to the location of the snapshot files and execute the following command—

    If snapshot is from a VM where guest OS is Windows 8/Server 2012 or later:
    vmss2core.exe -W8 snapshot.vmsn snapshot.vmem

    If snapshot is from a VM where guest OS is older Windows:
    vmss2core.exe -W snapshot.vmsn snapshot.vmem

    If snapshot is from a VM where guest OS is Linux:
    vmss2core.exe -N snapshot.vmsn snapshot.vmem

(Note: vmsn may be vmss, and the vmem file may not be present or necessary.)
Successful output should be a "memory.dmp" (or "vmss.core" in case of Linux)

Techincal References

Converting a snapshot file to memory dump using the vmss2core tool (2003941)

Identifying critical Guest OS failures within virtual machines (1003999)