Extracting a core dump file from the diagnostic partition following a purple diagnostic screen error

Products

• VMware vSphere ESXi

Issue/Introduction

This article provides information on extracting a core dump file from the diagnostic partition following a purple diagnostic screen error.

During a purple diagnostic screen, ESXi attempts to write a VMkernel core dump to a previously-configured VMKCore (type 0xFC) partition. This file is normally created during start up or while collecting vm-support logs.

In ESXi 5.5 and higher, a VMkernel core dump may be written to a dump file, either in addition or instead of a partition. For such cases, see Generating a VMkernel zdump manually from a dump file in ESXi.

For more information on related topics, see:

• Setup: Configuring an ESXi/ESX host to capture a VMkernel coredump from a purple diagnostic screen.
• Investigation: Interpreting a host purple diagnostic screen.
• vSphere 6.5, support bundles can include encrypted information from an ESXi host. For more information, see Data collected when gathering diagnostic information from vSphere products.

Environment

VMware vSphere ESXi 8.x

VMware vSphere ESXi 7.x

VMware vSphere ESXi 6.x

Resolution

The command line utility for extracting a VMkernel core dump differs between versions of ESXi/ESX.

vSphere 6.x and higher

Use command-line tools on the ESXi host to identify the diagnostic partition and copy its contents to a file.

1. Connect to ESXi host using SSH
   
   
2. Determine the device identifiers for the diagnostic partition(s) by running one of these commands:
   
   
   • esxcli system coredump partition list
   • esxcfg-dumppart -t
   
   You see output mentioning a device name and full path to the partition (
   
   mpx.vmhba1:C0:T0:L0:7 /vmfs/devices/disks/mpx.vmhba1:C0:L0:7
   
   
3. A core dump file is between 100 and 300 MB in size. Change to a directory with sufficient space to store the core dump file, such as on a Datastore.
   
   For example:
   
   cd /vmfs/volumes/DatastoreName/
   
   
4. Copy the partition contents to a file by running the esxcfg-dumppart command, specifying the full path from step 2:
   
   esxcfg-dumppart --copy --devname "/vmfs/devices/disks/identifier" --zdumpname /vmfs/volumes/datastore1/filename.1
   
   For example:
   
   esxcfg-dumppart --copy --devname "/vmfs/devices/disks/mpx.vmhba2:C0:T0:L0:2" --zdumpname /vmfs/volumes/datastore1/hostname-date-zdump
   
   
5. Use the Datastore Browser or scp to retrieve the produced zdump file, and share it with VMware Support.