Extracting the log file after an ESX or ESXi host fails with a purple screen error

Products

• VMware vSphere ESXi

Issue/Introduction

This article provides steps to extract a log from a vmkernel-zdump file after a purple diagnostic screen error. This log contains similar information to that seen on the purple diagnostic screen and can be used in further troubleshooting.

This article assumes that a vmkernel-zdump file is available. If an ESX or ESXi host has failed with a purple diagnostic screen, but no vmkernel-zdump file is available, see:

 

• Configuring an ESXi/ESX host to capture a VMkernel coredump from a purple diagnostic screen
• Extracting a core dump file from the VMKCore diagnostic partition following a purple diagnostic screen error

 

Environment

vSphere ESXi 6.x
vSphere ESXi 7.x
vSphere ESXi 8.x

Resolution

To extract the log file from a vmkernel-zdump file:

1. Find the vmkernel-zdump file in the /root/ or /var/core/ directory:
   
   # ls /root/vmkernel* /var/core/vmkernel*
/var/core/vmkernel-zdump-073108.09.16.1
    
2. Use the vmkdump or esxcfg-dumppart utility to extract the log. For example:
   
   # vmkdump -l /var/core/vmkernel-zdump-073108.09.16.1
created file vmkernel-log.1

# esxcfg-dumppart -L /var/core/vmkernel-zdump-073108.09.16.1
created file vmkernel-log.1
    
3. The vmkernel-log.1 created above is a file in plain text that you can read with a text editor, though may start with null characters. Focus on the end of the log, which is similar to:
   
   VMware ESX Server [Releasebuild-98103]
PCPU 1 locked up. Failed to ack TLB invalidate.
frame=0x3a37d98 ip=0x625e94 cr2=0x0 cr3=0x40c66000 cr4=0x16c
es=0xffffffff ds=0xffffffff fs=0xffffffff gs=0xffffffff
eax=0xffffffff ebx=0xffffffff ecx=0xffffffff edx=0xffffffff
...
    
4. For troubleshooting the cause of the purple diagnostic screen, see Interpreting an ESX host purple diagnostic screen.

Note: The file name created for the log in this example is vmkernel-log.1. If another file with the same name already exists, the new file is created with the number suffix incremented.

Additional Information

If you require further assistance in diagnosing a purple diagnostic screen error:

• Review the main article in this series, Interpreting an ESX host purple diagnostic screen.
• Gather diagnostic information from the VMware ESX host. For more information, see Collecting diagnostic information for VMware products.
• Open a support request. For more information, see Creating and managing Broadcom support cases

Generating a VMkernel zdump manually from a dump file in ESXi host