Overview of virtual machine snapshots in vSphere

Products

VMware vSphere ESXi

Issue/Introduction

This article provides an overview of virtual machine snapshots in vSphere.

Note: Snapshots should not be considered as a backup for any virtual disks associated with the VMs. Running a virtual machine on a snapshot for extended periods of time can cause instability and data loss. For more information, see Best practices for using snapshots in the vSphere environment

Snapshots can be used for development and testing purposes. It can be considered as a quick failsafe to be able to rollback before a patch performing tests on certain applications residing on VM.

Symptoms:

Environment

VMware vSphere ESXi 6.5
VMware vSphere ESXi 7.0.0
VMware vSphere ESXi 6.0
VMware vSphere ESXi 5.5
VMware vSphere ESXi 6.7

Resolution

For troubleshooting issues with snapshots see: Troubleshooting issues when creating or committing snapshots in VMware ESXi/ESX

Understanding Virtual Machine Snapshots in VMware ESXi:

The below video provides the information about Virtual Machine Snapshots in VMware ESXi:

What is a Snapshot?

A snapshot preserves the state and data of a virtual machine at a specific point in time.

The state includes the virtual machine’s power state (for example, powered-on, powered-off, suspended).
The data includes all of the files that make up the virtual machine. This includes disks, memory, and other devices, such as virtual network interface cards.

A virtual machine provides several operations for creating and managing snapshots and snapshot chains. These operations let you create snapshots, revert to any snapshot in the chain, and remove snapshots. You can create extensive snapshot trees.

Configuring VMware vCenter Server to send alarms when virtual machines are running from snapshots (1018029).

vSphere informs you via the UI if the consolidation part of a Delete Snapshot or Delete All Snapshots operation has failed. The option Consolidate, is available via the Snapshot menu to consolidate the snapshots. For more information about Consolidating/Committing Snapshots in ESXi (1002310)

For more information about Configuring vCenter Server to send alarms when virtual machines are running from snapshots (1018029)

Note: Considerations with VMware Snapshot and Oracle workloads

Process to Create a Snapshot

When creating a snapshot, there are several options you can specify:

Name: This is used to identify the snapshot.
Description: This is used to describe the snapshot.
Memory: If the flag is 1 or true, a dump of the internal state of the virtual machine is included in the snapshot. Memory snapshots take longer to create, but allow reversion to a running virtual machine state as it was when the snapshot was taken. This option is selected by default. If this option is not selected, and quiescing is not selected, the snapshot will create files which are crash-consistent, which you can use to reboot the virtual machine.

Note: When taking a memory snapshot, the entire state of the virtual machine will be stunned. For more information, see Taking a snapshot with virtual machine memory renders the virtual machine to an inactive state while the memory is written to disk (1013163).
Quiesce: If the flag is 1 or true, and the virtual machine is powered on when the snapshot is taken, VMware Tools is used to quiesce the file system in the virtual machine. Quiescing a file system is a process of bringing the on-disk data of a physical or virtual computer into a state suitable for backups. This process might include such operations as flushing dirty buffers from the operating system's in-memory cache to disk, or other higher-level application-specific tasks.

Notes:

Quiescing indicates pausing or altering the state of running processes on a computer, particularly those that might modify information stored on disk during a backup, to guarantee a consistent and usable backup.
Quiescing and Memory snapshots are mutually exclusive. The vSphere Web Client and HTML5 Client already enforce this policy whilst the vSphere Client 6.0 just ignores Quiescing if Memory snapshot and Quiescing are selected at the same time.

Child Disks and Disk Usage

When a snapshot is created, it is comprised of these files:

-.vmdk and --delta.vmdk

A collection of .vmdk and -delta.vmdk files for each virtual disk is connected to the virtual machine at the time of the snapshot. These files can be referred to as child disks or delta links. These child disks can later be considered parent disks for future child disks. From the original parent disk, each child constitutes a delta pointing back from the present state of the virtual disk, one step at a time, to the original.

Note:
- The value may not be consistent across all child disks from the same snapshot. The file names are chosen based on filename availability.
- If the virtual disk is larger than 2TB in size, the delta file is of --sesparse.vmdk format.
- With VMFS6 all snapshots will be sesparse regardless of the size.
.vmsd

The .vmsd file is a database of the virtual machine's snapshot information and the primary source of information for the Snapshot Manager. The file contains line entries which define the relationships between snapshots as well as the child disks for each snapshot.
Snapshot.vmsn

The .vmsn file includes the current configuration and optionally the active state of the virtual machine. Capturing the memory state of the virtual machine lets you revert to a turned on virtual machine state. With nonmemory snapshots, you can only revert to a turned off virtual machine state. Memory snapshots take longer to create than nonmemory snapshots.

Notes:

The preceding files are placed in the working directory by default. This behavior can be changed if desired. For more information on creating snapshots in another directory, see Creating snapshots in a different location than default virtual machine directory (1002929).
Snapshot descriptor and delta vmdk files are stored in the same location as the virtual disks (which can be in a different directory to the working directory). To change this behavior, see Changing the location of snapshot delta files for virtual machines in ESXi 5.x (2007563)

It is important to note these points regarding the space utilization of child disks:

If a virtual machine is running on a snapshot, it is making changes to a child disk. The more write operations made to this disk, the larger it grows, to an upper limit of the size allocated to the disk plus a small amount of overhead. This is true for each delta.
Child disks are known to grow large enough to fill an entire datastore, but this is because the LUN containing the datastore was insufficiently large to contain the base disk, the number of snapshots created, and the overhead and .vmsn files created.

For more information on child disks and disk usage, see:

The Disk Chain

Generally, when you create a snapshot for the first time, the first child disk is created from the parent disk. Successive snapshots generate new child disks from the last child disk on the chain. The relationship can change if you have multiple branches in the snapshot chain.

This diagram is an example of a snapshot chain. Each square represents a block of data or a grain as described in the preceding section:

Caution: Manually manipulating the individual child disks or any of the snapshot configuration files may compromise the disk chain. VMware does not recommend manually modifying the disk chain as it may result in data loss. For more information, see Consolidating/Committing Snapshots in ESXi (1002310)

Additional Information

VMware Skyline Health Diagnostics for vSphere - FAQ
Managing snapshots in vSphere Web Client
Snapshot removal stops a virtual machine for long time
To determine if a virtual machine is running on snapshots, see Determining if a virtual machine is using snapshots (1004343).
There are specific considerations when hosting a Microsoft Active Directory controller in a virtual environment. For a full list of considerations, see the Microsoft Knowledge Base article 888794 .

Note: The preceding link was valid as of December 19th, 2019. If you find the link to be broken, provide feedback on the article and a VMware employee will update the article as necessary.

Time-sensitive applications may be impacted by reverting to a previous snapshot. Reverting the snapshot will revert the virtual machine to the point in time when the snapshot was created. This includes any operations conducted by the time-sensitive service or application in the guest operating system.
Reverting virtual machines to a snapshot causes all settings configured in the guest operating system since that snapshot to be reverted. The configuration which is reverted includes, but is not limited to, previous IP addresses, DNS names, UUIDs, guest OS patch versions, etc.

For more related information see: