Extracting a core dump file from the diagnostic partition following a purple diagnostic screen error

Products

VMware vSphere ESXi

Issue/Introduction

This article provides information on extracting a core dump file from the diagnostic partition following a purple diagnostic screen error.

During a purple diagnostic screen, ESXi/ESX attempts to write a VMkernel core dump to a previously-configured VMKCore (type 0xFC) partition. This file is normally created during start up or while collecting vm-support logs.

In ESXi 5.5 and higher, a VMkernel core dump may be written to a dump file, either in addition or instead of a partition. For such cases, see Generating a VMkernel zdump manually from a dump file in ESXi (2081902).

For more information on related topics, see:

Setup: Configuring an ESXi/ESX host to capture a VMkernel coredump from a purple diagnostic screen (1000328)
Collection: Collecting diagnostic information from an ESX or ESXi host that experiences a purple diagnostic screen (1004128)
Investigation: Interpreting an ESXi/ESX host purple diagnostic screen (1004250)
vSphere 6.5, support bundles can include encrypted information from an ESXi host. For more information, see Data collected when gathering diagnostic information from vSphere products (2147388).

Environment

VMware ESX Server 3.0.x
VMware vSphere ESXi 5.1
VMware ESXi 4.1.x Installable
VMware vSphere ESXi 5.0
VMware vSphere ESXi 7.0.0
VMware ESX 4.1.x
VMware vSphere ESXi 6.0
VMware ESXi 4.1.x Embedded
VMware ESXi 3.5.x Embedded
VMware vSphere ESXi 5.5
VMware ESXi 3.5.x Installable
VMware ESXi 4.0.x Embedded
VMware ESX 4.0.x
VMware ESX Server 3.5.x
VMware vSphere ESXi 6.5
VMware ESXi 4.0.x Installable

Resolution

The command line utility for extracting a VMkernel core dump differs between versions of ESXi/ESX.

vSphere 4.0 and higher

Use command-line tools on the ESXi host to identify the diagnostic partition and copy its contents to a file.

Log in to the ESXi/ESX host:
- For ESX classic, log into the service console as root. For more information, see Unable to connect to an ESX host using Secure Shell (SSH) (1003807).
- For ESXi, log in using Tech Support Mode. For more information, see Using Tech Support Mode in ESXi 4.1 and ESXi 5.x (1017910).
- For ESXi or ESX, log into your vMA appliance as vi-admin and run this command:
  
  vifpinit host
  
  Note: In vMA, the vifpinit command is replaced with the vifptarget command.
Determine the device identifiers for the diagnostic partition(s) by running one of these commands:
- esxcli system coredump partition list
- esxcfg-dumppart -t
You see output mentioning a device name and full path to the partition (

mpx.vmhba1:C0:T0:L0:7 /vmfs/devices/disks/mpx.vmhba1:C0:L0:7
A core dump file is between 100 and 300 MB in size. Change to a directory with sufficient space to store the core dump file, such as on a Datastore.

For example:

cd /vmfs/volumes/DatastoreName/
Copy the partition contents to a file by running the esxcfg-dumppart command, specifying the full path from step 2:

esxcfg-dumppart --copy --devname "/vmfs/devices/disks/identifier" --zdumpname /vmfs/volumes/datastore1/filename.1

For example:

esxcfg-dumppart --copy --devname "/vmfs/devices/disks/mpx.vmhba2:C0:T0:L0:2" --zdumpname /vmfs/volumes/datastore1/hostname-date-zdump
Use the Datastore Browser or scp to retrieve the produced zdump file, and share it with VMware Support.

ESXi/ESX 3.x

To generate a core dump file on ESXi/ESX 3.x:

Log into the ESXi/ESX host:
- For ESX classic, log into the service console as root. For more information, see Unable to connect to an ESX host using Secure Shell (SSH) (1003807).
- For ESXi, log in using Tech Support Mode. For more information, see Tech Support Mode for Emergency Support (1003677).
Determine the device identifiers for the core partition(s) by running the command:

esxcfg-dumppart -t

You see one of these outputs:
- vmhba1:0:0:7 /vmfs/devices/disks/vmhba1:0:0:7
- naa.600508b1001030374543433532300700:7 /vmfs/devices/disks/naa.600508b1001030374543433532300700:7
- naa.6d4ae520a23d1500178db21c1837fead:7 /vmfs/devices/disks/naa.6d4ae520a23d1500178db21c1837fead:7 naa.600508b1001030374543433532300700:7 /vmfs/devices/disks/naa.600508b1001030374543433532300700:7
If there is no output in step 2, set one of the volumes as the dump partition using the command:

esxcfg-dumppart -s naa.ID
Activate the partition using the command:

# esxcfg-dumppart -a Dump Partition activated.
Change to a directory with sufficient space to store the core dump file.

For example:

cd /vmfs/volumes/DatastoreName/
Dump the partition contents to a file by running the command:

vmkdump --devname "identifier"

Where identifier is the value recorded in step 2.

For example:

vmkdump --devname "/vmfs/devices/disks/vmhba1:0:0:0:7"

Additional Information

For translated versions of this article, see: