All Products: How to collect a memdump from a snapshot of a VMware machine

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)

Issue/Introduction

Create a memory dump from a snapshot of a machine running on VMware virtualization software

Environment

• All Products
  • Carbon Black Cloud
  • App Control
  • EDR
• Microsoft Windows: All Supported Versions
• Apple macOS: All Supported Versions
• Linux: All Supported Versions
• VMware virtual appliance

Resolution

1. Reproduce the issue the needs to be captured in the dump
2. Follow the steps documented in Converting a snapshot file to memory dump using the vmss2core tool
3. Upload resulting dump to CB Vault
4. Update the Support case once the upload is complete

Additional Information

Memdumps from a snapshot are useful in situations where the machine is in a hung state and a dump cannot be triggered.