vmss2core – Fling from VMware

Whilst working on a call with Microsoft this week they needed a full memory dump from a server.
The windows server wasn’t being particularly cooperative with running a program to make it blue screen and produce a complete memory dump so the support guy advised me of a rather cool way to get my memory dump.

Basically you can snapshot, or in my case suspend the server, then using a cool fling from VMware called vmss2core you can take a copy of the suspend file (VMSS) and convert this file to be a core dump file.

What’s more the vmss2core tool can produce core dump files for:

• The Windows debugger (WinDbg)
• Red Hat crash compatible core files
• A physical memory view suitable for the Gnu debugger gdb
• Solaris MDB (XXX)
• Mac OS X formats

So to run the file you simple point vmss2core.exe at the VMSS file you have copied off your ESXi host and it will convert it for you.
To run the file you simply type vmss2core -W .vmss
There are different options depending on what format you want the dump file in.
For more information see the following PDF snapshot2core_technote

So in my case I entered vmss2core -W D:\memorydump\suspendfile.vmss
And just 6 minutes later it had taken my 16GB suspend file and created a 16GB memory dump.

My biggest problem was finding a place where I could:

• Copy my 16GB suspend file to.
• Have sufficient space to create another 16GB memory dump file.

In the end I simply added a new 40GB disk to a server temporally to allow me to save my suspend file, convert it and upload it to Microsoft.

To download the Fling simply go to https://labs.vmware.com/flings/vmss2core
The instructions can be found http://www.vmware.com/pdf/snapshot2core_technote.pdf

Don’t forget as it’s a fling to go back and check for updates regularly, the current version was dated January the 13th so just three weeks ago.