Converting virtual machine snapshots to memory dumps in VMware vSphere

Products

• VMware vCenter Server
• VMware vSphere ESXi

Issue/Introduction

The steps in this article capture a memory dump from a VMware virtual machine without stopping its execution. This is useful in cases where forcing a crash or changing the Windows dump parameters is not permitted.

Environment

VMware vSphere ESXi 8.x
VMware vCenter Server 8.x

Resolution

1. When the virtual machine hangs, crashes, or otherwise displays symptoms, go into the VMware vCenter, Workstation, or Fusion interface and take a snapshot of the virtual machine with the "Include virtual machine's memory" option selected. Optionally, suspend the virtual machine.
2. Browse to the file location where the virtual machine is located. This may vary depending on the VMware product in use. For example, within vCenter, right-click the virtual machine and browse the datastore where the virtual machine resides.
3. Locate the folder with the same name as the virtual machine.
4. Inside the folder, locate the snapshot files. There is a snapshot (.vmsn) or suspend file (.vmss) in the virtual machine directory, and a non‑monolithic memory (.vmem) file, all with the same base name (e.g., servername-Snapshot3) with different suffixes (.vmsn, .vmss, and/or .vmem). If there are different snapshots (e.g., servername-Snapshot1, 2, 3, etc.), locate the correct files for the recent snapshot or suspension by examining the time/date stamps.
5. Save a copy of all files that are present (.vmsn, .vmss, and .vmem) for the snapshot. In vSphere Client, right-click the files, choose download, and save them to the local machine. Zip them up and send them to the Technical Support Vendor requesting the core dump.
6. Download the vmss2core.exe file: Where to Download vmss2core.exe
   (The vmss2core tool can be downloaded as a standalone utility in the Free Downloads section of the Broadcom Support Portal: Download VMware Flings for Free)
7. Copy the vmss2core.exe utility to the location where the .vmsn or .vmss and .vmem files are located locally.
8. Open a command line, navigate to the location of the snapshot files, and execute the following command:

1. 1. If the snapshot is from a virtual machine where the guest OS is Windows 8/Server 2012 or later: (note: use the actual names of the files download, as these are just examples. Ensure the .vmsn file is listed first, followed by the .vmem file.)
      vmss2core.exe -W8 snapshot.vmsn snapshot.vmem

   2. If using Microsoft Windows and willing to perform the default operation of converting the virtual machine snapshot into a core dump:
      vmss2core.exe snapshot.vmsn snapshot.vmem
   3. If the snapshot is from a virtual machine where the guest OS is an older Windows version:
      vmss2core.exe -W snapshot.vmsn snapshot.vmem
   4. If the snapshot is from a virtual machine where the guest OS is Linux:
      vmss2core.exe -N snapshot.vmsn snapshot.vmem

Note: The .vmsn file may be a .vmss file, and the .vmem file may not be present or necessary. Successful output generates a memory.dmp file (or vmss.core in the case of Linux).
      
      

• For further assistance: Contact Broadcom support

Additional Information

Identifying critical Guest OS failures within virtual machines

Note: If the memory dump generates with 0KB, verify if Hyper-V is enabled for the virtual machine. Open the .vmx configuration file and check for the following line:

1. 1. vhv.enable = "TRUE"
   2. If this setting is set to "TRUE", change it to vhv.enable = "FALSE".
   3. If the memory dump generates with 0KB and Hyper-V is not enabled on the virtual machine, check the Windows OS build. If it is an older build, update it to the latest version.

The vmss2core tool may be downloaded as a standalone utility from the Free Downloads section of the Broadcom Support Portal: Download VMware Flings for Free , Direct Download link for vmss2core