Converting a snapshot file to memory dump using the vmss2core tool

Products

VMware Desktop Hypervisor VMware vSphere ESXi

Issue/Introduction

This article provides steps to convert a snapshot file to a memory dump using vmss2core tool. Developers can use this tool to debug guest operating systems and applications by converting a virtual machine checkpoint into a core dump file. The checkpoint can either be a snapshot or suspend file and a variety of core dump format can be selected for use in various standard debuggers.

Environment

VMware Fusion

VMware Workstation
VMware vSphere ESXi

Resolution

To create the memory dump if the virtual machine is installed on Workstation 7.x and above or Fusion 3.x and above.

Change directory to one of these locations depending on the installation type:
- Windows (32bit versions) – C:\Program Files\VMware\VMware Workstation\
- Windows (64bit versions) - C:\Program Files(x86)\VMware\VMware Workstation\
- Linux – /usr/bin/
- Mac OS – /Library/Application Support/VMware Fusion/
  
  Note:
  - If vmss2core is not available in these install directories, it can be downloaded here: https://archive.org/download/flings.vmware.com/Flings/Vmss2core/ however it is not officially supported.
  - The alternate site to download this (vmss2core) and other Flings is https://community.broadcom.com/flings/home
  - Flings are not officially supported and should not be used in a production environment
Run the vmss2core tool with the correct option (depending on the guest OS) to create a memory dump:

# vmss2core.exe -W virtual_machine_name.vmss virtual_machine_name.vmem

If using Microsoft Windows 8/8.1, Windows Server 2012, Windows Server 2016 or Windows Server 2019 run this command:

# vmss2core.exe -W8 virtual_machine_name.vmss virtual_machine_name.vmem

If using Linux, use the command:

# ./vmss2core-Linux64 -N virtual_machine_name.vmss

Note: The flag -W, -W8, or -N is to reference the virtual machine's Guest OS and not the workstation machine we are running the command from.

To create the memory dump if the virtual machine is on an ESX/ESXi host:

Start a SSH session to the ESXi host.
Run this command to determine the world ID of the virtual machine:

# vm-support -x

Note: Regarding ESXi 6.7, use command esxcli vm process list

Run this command to suspend the virtual machine:

# vm-support –Z world_ID

For a comprehensive list of these commands for all ESXi versions, see Suspending a virtual machine on ESX/ESXi to collect diagnostic information

Note: If the vm-support -Z does not work with your ESXi version there are other options:

https://knowledge.broadcom.com/external/article?articleNumber=326327#3

4. Copy the virtual_machine_name.vmss file to the location where the vmss2core tool is located.

Note: If virtual_machine_name.vmem exist, copy to the same location as above.

Run the vmss2core tool with the option to create a memory dump.

# vmss2core –W virtual_machine_name.vmss

If using Microsoft Windows 8/8.1, Windows Server 2012, Windows Server 2016 or Windows Server 2019 run this command:
# vmss2core -W8 virtual_machine_name.vmss

If using Microsoft Windows and willing perform the default operation of converting the VM snapshot into a core dump, run this command:

# vmss2core virtual_machine_name.vmss virtual_machine_name.vmem

If using Linux, use the command:
# ./vmss2core-Linux64 -N virtual_machine_name.vmss

Note: The flag -W, -W8, or -N is to reference the virtual machine's Guest OS and not the jump-box machine the command is run from.

For extracting the memory dumps on windows:

Converting a VMware virtual machine snapshot to a memory dump

Additional Information

For additional information, see the Debugging Virtual Machines with the Checkpoint to Core Tool Guide.

Suspending a virtual machine on ESX/ESXi to collect diagnostic information
vmss2core ツールを使用してスナップショットファイルをメモリダンプに変換する