This is something could be requested by an application vendor for debugging purpose to investigate an application related issue. If you get any such request for VM memory dump then you might wonder how to capture a memory dump from a VMware virtual machine without stopping its execution.
If this is a production VM then you might not want to force a crash or change Windows dump parameters and reboot the machine. So, how can we capture a memory dump of a VM without interrupting it.
There is a VMware fling called vmss2core, using which we can convert the checkpoint state files into formats that third party debugger tools understand. It can handle both suspend (.vmss) and snapshot (.vmsn) checkpoint state files as well as both monolithic and non-monolithic (separate .vmem file) encapsulation of checkpoint state data.
The vmss2core tool can produce core dump files for the Windows debugger (WinDbg) as well as for other operating systems. Please refer to given screenshot for more info.
For more info about usages of vmss2core tool, please refer to Debugging Virtual Machines with the Checkpoint to Core Tool
We need to take a snapshot of affected VM when it hangs, crashes, or otherwise display symptoms you are troubleshooting and then download the snapshot state file (.vmsn) and VM paging file (.vmem) which can later be converted to Windows memory dump file (.dmp) using vmss2core utility.
Steps:
1. Copy the vmss2core.exe utility to the same location where you downloaded the VM snapshot or suspended state files (.vmsn – in case of snapshot or .vmss for suspended state).
2. Open a command line and navigate to the location of the snapshot / suspended state files and execute the following command:
Here you would use the tool with OS‐specific options. For example, this command generates a memory.dmp file for the Windows debugger, WinDbg.
For Snapshot:
C:\folder>vmss2core.exe -W snapshot.vmsn [snapshot.vmem]
For Suspended state:
C:\folder>vmss2core.exe -W snapshot.vmss
If the snapshot file is from a Windows 8 or Windows Server 2012 VM, use
C:\folder>vmss2core.exe -W8 snapshot.vmsn [snapshot.vmem]
Successful output of this should be a "memory.dmp" file suitable for use with WinDbg
Please note: VM paging file (.vmem file) may not be present depend on the state of VM.
Related VMware kb# 2003941
That's it... :)
If this is a production VM then you might not want to force a crash or change Windows dump parameters and reboot the machine. So, how can we capture a memory dump of a VM without interrupting it.
There is a VMware fling called vmss2core, using which we can convert the checkpoint state files into formats that third party debugger tools understand. It can handle both suspend (.vmss) and snapshot (.vmsn) checkpoint state files as well as both monolithic and non-monolithic (separate .vmem file) encapsulation of checkpoint state data.
The vmss2core tool can produce core dump files for the Windows debugger (WinDbg) as well as for other operating systems. Please refer to given screenshot for more info.
We need to take a snapshot of affected VM when it hangs, crashes, or otherwise display symptoms you are troubleshooting and then download the snapshot state file (.vmsn) and VM paging file (.vmem) which can later be converted to Windows memory dump file (.dmp) using vmss2core utility.
Steps:
1. Copy the vmss2core.exe utility to the same location where you downloaded the VM snapshot or suspended state files (.vmsn – in case of snapshot or .vmss for suspended state).
2. Open a command line and navigate to the location of the snapshot / suspended state files and execute the following command:
Here you would use the tool with OS‐specific options. For example, this command generates a memory.dmp file for the Windows debugger, WinDbg.
For Snapshot:
C:\folder>vmss2core.exe -W snapshot.vmsn [snapshot.vmem]
For Suspended state:
C:\folder>vmss2core.exe -W snapshot.vmss
If the snapshot file is from a Windows 8 or Windows Server 2012 VM, use
C:\folder>vmss2core.exe -W8 snapshot.vmsn [snapshot.vmem]
Successful output of this should be a "memory.dmp" file suitable for use with WinDbg
Please note: VM paging file (.vmem file) may not be present depend on the state of VM.
Related VMware kb# 2003941
That's it... :)
