Virtual Machine enters "Suspended" state during diagnostic data collection with vmdumper.log activity

Products

• VMware vSphere ESXi

Issue/Introduction

• A Virtual Machine (VM) unexpectedly transitions into a Suspended state.

• The vmware.log file contains the message: vmx - SUSPEND: Start suspend (flags=0).

• A file named vmdumper.log exists in the Virtual Machine's working directory.

• Review of the vmdumper.log reveals the command suspend_vm executed at the time of the event:

  Plaintext

   

  Running /sbin/vmdumper <WorldID> suspend_vm
  Suspending VM...
  Dumping unsync cores...

Environment

VMware vSphere ESXi

VMware vCenter Server

Cause

The Virtual Machine was suspended intentionally by the ESXi host's diagnostic subsystem (vmdumper) to capture a consistent memory state. This occurs when an administrator initiates a log collection like the one listed in Generating a VMkernel zdump manually from a dump file in ESXi host

The presence of Running /sbin/vmdumper ... suspend_vm in the logs confirms that the suspension was an explicit step in the data collection script, not a crash or resource scheduler action.

Resolution

This behavior is expected when those options are selected. To return the VM to service:

1. Resume the VM:

   • Log in to the vSphere Client or ESXi Host Client.

   • Right-click the suspended Virtual Machine.

   • Select Power > Power On (or Resume).

2. Verify Timestamps (Optional):

   • Compare the "Date Modified" timestamp of the vmdumper.log file in the VM's datastore folder with the suspension time in vCenter events. A match confirms the dump generation caused the suspension.

WORKAROUND

To collect logs without suspending the VM in the future:

• Use the standard Export System Logs workflow.

• Ensure options related to "Hung VM," "Memory Checkpoint," or "Performance Snapshots" are deselected unless the VM is actually unresponsive and a core dump is required for root cause analysis.