How to convert a VMware virtual machine snapshot to a memory dump


Article ID: 181598


Updated On:


Symantec Products Endpoint Protection




How to capture a memory dump from a VMware virtual machine without stopping its execution. This is useful in cases where customers do not want to force a crash or change Windows dump parameters and reboot the machine. This procedure can be done without interrupting the execution of the machine.

How to capture a memory dump from a VMware virtual machine

  1. When the VM hangs, crashes, or otherwise displays symptoms you are troubleshooting, then go into VMware vCenter, Workstation, or Fusion interface and take a snapshot. You may also choose to suspend the VM.
  2. Browse to the file location where the VM is located. This may vary depending on the VMware product you are using. Within VCenter, you can do this in VM properties by right clicking and browsing the datastore where the VM is located.
  3. Locate the folder with the same name as the VM.
  4. Inside the folder, locate the snapshot files. There will be a snapshot (.vmsn) or suspend file (.vmss) in the virtual machine directory, and a nonā€monolithic memory (.vmem) file, all with the same base name e.g. servername-Snapshot3 with different suffixes (vmsn, vmss, and/or vmem). If there are different snapshots, e.g. servername-Snapshot1, 2, 3, etc then locate the correct files for your recent snapshot or suspension by examining time/date stamps.
  5. Save a copy of all files that are present (.vmsn, .vmss, and .vmem) for your snapshot. In vCenter you can right click on the files and choose Download and save them to the local machine. Zip them up and send them to Symantec Support.

    The following steps are for your information only -- it is not necessary to perform them; Symantec support can convert the snapshot files themselves.
  6. Copy the vmss2core.exe utility to the same location as the snapshot files. See for instructions.
  7. Open a command line and navigate to the location of the snapshot files and execute the following command: vmss2core.exe -W snapshot.vmsn snapshot.vmem

If the snapshot file is from a Windows 8/Server 2012 or later VM, the command line is vmss2core.exe -W8 snapshot.vmsn snapshot.vmem

(Note: vmsn may be vmss, and the vmem file may not be present or necessary.)
Successful output should be a "memory.dmp" file suitable for use with WinDbg

Techincal References

Converting a snapshot file to memory dump using the vmss2core tool (2003941)

Identifying critical Guest OS failures within virtual machines (1003999)