Encrypted core dump following ESXi host PSOD

Products

• VMware vSphere ESXi

Issue/Introduction

Following a Purple Screen of Death (PSOD) event on an ESXi host, the core dump was found to be encrypted. This is expected behavior in environments where vSphere Virtual Machine Encryption is enabled.

Environment

VMware vSphere ESXi 7.x and later versions.

Cause

When vSphere Virtual Machine Encryption is enabled, ESXi core dumps are automatically encrypted to protect sensitive customer data. This includes the core dumps bundled within the vm-support packages. As a result, any diagnostic information collected from the host may also be encrypted.

Resolution

If a core dump is found to be encrypted, it must be manually decrypted before analysis. Customers or administrators can perform the decryption using the following steps:

1. SSH into the affected ESXi host.
2. Check if the core dump is encrypted:
   crypto-util envelope describe --offset 4096 /var/core/vmkernel-zdump.1
3. If the dump is confirmed to be encrypted, extract (decrypt) the core file:
   crypto-util envelope extract --offset 4096 /var/core/vmkernel-zdump.1 /var/core/unenc-vmkernel-zdump.1
4. Once decrypted, the file located at /var/core/unenc-vmkernel-zdump.1 can be safely uploaded for support and analysis.

Further Information:

For more details on this behavior and managing encrypted core dumps, please refer to VMware's official documentation:

🔗 vSphere Virtual Machine Encryption and Core Dumps – TechDocs

Additional Information

Updated tech.doc link

vSphere Virtual Machine Encryption and Core Dumps