Converting a snapshot file to memory dump using the vmss2core tool

Products

VMware Desktop Hypervisor VMware vSphere ESXi

Issue/Introduction

This article provides steps to convert a snapshot file to a memory dump using vmss2core tool.
Developers can use this tool to debug guest operating systems and applications by converting a virtual machine checkpoint into a core dump file. The checkpoint can either be a snapshot or suspend file. You can select a variety of core dump formats that standard debuggers understand.

Symptoms:

Cannot run the vmss2core tool.
Running the vmss2core tool fails.
In the command line, you see the error:

Failed to locate memory. Memory block and no separate .vmem file supplied

Environment

VMware Workstation 9.x (Linux)
VMware vSphere ESXi 5.5
VMware Fusion 8.x
VMware Workstation 7.x (Linux)
VMware Workstation 11.x (for Linux)
VMware Workstation 11.x (for Windows)
VMware Workstation 10.x (Windows)
VMware Fusion 3.x
VMware Workstation 8.x (Linux)
VMware vSphere ESXi 6.7
VMware Fusion 6.x
VMware vSphere ESXi 6.0
VMware Workstation 10.x (Linux)
VMware Fusion 4.x
VMware Workstation 8.x (Windows) Pre-release
VMware Fusion 7.x
VMware Workstation 7.x (Windows)
VMware Workstation 8.x (Linux) Pre-release
VMware vSphere ESXi 7.0.0
VMware Fusion 5.x
VMware vSphere ESXi 6.5
VMware Workstation 8.x (Windows)

Resolution

To create the memory dump if the virtual machine is installed on Workstation 7.x and above or Fusion 3.x and above.

Change directory to one of these locations depending on your installation type:
- Windows (32bit versions) – C:\Program Files\VMware\VMware Workstation\
- Windows (64bit versions) - C:\Program Files(x86)\VMware\VMware Workstation\
- Linux – /usr/bin/
- Mac OS – /Library/Application Support/VMware Fusion/
  
  Note: If vmss2core is not available in these install directories, it can be downloaded. The vmss2core is available at Fling Link is not supported and is to be used at your own risk.
Run the vmss2core tool with the correct option (depending on your guest OS) to create a memory dump:

# vmss2core.exe -W virtual_machine_name.vmss virtual_machine_name.vmem

If you are using Microsoft Windows 8/8.1, Windows Server 2012, Windows Server 2016 or Windows Server 2019 run this command:

# vmss2core.exe -W8 virtual_machine_name.vmss virtual_machine_name.vmem

If you are using Linux, use the command:

# ./vmss2core-Linux64 -N virtual_machine_name.vmss

Note: The flag -W, -W8, or -N is to reference the virtual machine's Guest OS and not the jumpbox machine we are running the command from.

To create the memory dump if the virtual machine is on an ESX/ESXi host:

Start a SSH session to the host.
Run this command to determine the world ID of the virtual machine:

# vm-support -x

Note: Regarding ESXi 6.7, use command esxcli vm process list

Run this command to suspend the virtual machine:

# vm-support –Z world_ID

For a comprehensive list of these commands for all ESXi versions, see Suspending a virtual machine on ESX/ESXi to collect diagnostic information (2005831).
Copy the virtual_machine_name.vmss file to the location where you have the vmss2core tool.

Note: If virtual_machine_name.vmem exist, copy to the same location as above.

Run the vmss2core tool with the option to create a memory dump.

# vmss2core –W virtual_machine_name.vmss

If you are using Microsoft Windows 8/8.1, Windows Server 2012, Windows Server 2016 or Windows Server 2019 run this command:
# vmss2core -W8 virtual_machine_name.vmss

If you are using Linux, use the command:
# ./vmss2core-Linux64 -N virtual_machine_name.vmss

Note: The flag -W, -W8, or -N is to reference the virtual machine's Guest OS and not the jumpbox machine you are running the command from.

Additional Information

For additional information, see the Debugging Virtual Machines with the Checkpoint to Core Tool Guide.

Suspending a virtual machine on ESX/ESXi to collect diagnostic information
vmss2core ツールを使用してスナップショットファイルをメモリダンプに変換する
使用 vmss2core 工具将快照文件转换为内存转储