{"id":963,"date":"2012-04-16T09:30:32","date_gmt":"2012-04-16T13:30:32","guid":{"rendered":"http:\/\/enterpriseadmins.org\/blog\/?p=963"},"modified":"2012-04-14T12:49:37","modified_gmt":"2012-04-14T16:49:37","slug":"creating-and-reviewing-windows-crash-dumps-in-vmware-virtual-machines","status":"publish","type":"post","link":"https:\/\/enterpriseadmins.org\/blog\/virtualization\/creating-and-reviewing-windows-crash-dumps-in-vmware-virtual-machines\/","title":{"rendered":"Creating and Reviewing Windows crash dumps in VMware virtual machines"},"content":{"rendered":"

The other day I was assisting a co-worker who needed a memory dump of a Windows virtual machine. He was working with Microsoft support and the support engineer mentioned that the process for gathering this data was different since we were using a virtual machine. I Googled vmware windows memory dump<\/em> and found VMware KB 1001624<\/a>, which links to a Microsoft KB article that documents how to make CTRL+ScrollLock+ScrollLock cause a blue screen (which creates a memory dump). This process works the same on both physical and virtual servers.<\/p>\n

While that is a fun setting, and has a possible April Fools use case, it doesn’t really help troubleshoot issues. Using this option, the memory dump is caused by the user and requires an outage is required (a reboot to enable the registry key and a blue screen to create the memory dump).<\/p>\n

The tool the Microsoft engineer was talking about is vmss2core.exe<\/strong> and it ships with VMware Workstation. I haven’t had a chance to use it in the past, but it is very simple. Here are the steps I used to test this process:<\/p>\n

    \n
  1. Create a snapshot of a virtual machine with the ‘snapshot the virtual machines memory’ option selected.<\/li>\n
  2. Browse to the virtual machine’s folder on the VMFS or NFS volume and download the ‘-snapshot1.vmsn’ file to a temporary directory.<\/li>\n
  3. Copy the ‘vmss2core.exe’ file from a VMware Workstation installation to this temporary directory.<\/li>\n
  4. Run the following command (where ‘w2k3test01-snapshot1.vmsn’ is the name of your snapshot file):<\/li>\n<\/ol>\n
    vmss2core.exe w2k3test01-snapshot1.vmsn -W<\/pre>\n
    This process creates a memory.dmp file in the current directory. This file can be analyzed to determine what was running at the time of the snapshot creation. Note: the vmsn file is slightly larger than the amount of vRAM allocated to the virtual machine and the memory dump is equal to the amount of RAM installed. For a VM with 8GB of RAM you’ll need at least 16GB of disk space to complete this process.<\/em><\/p>\n
    How do I open these memory.dmp files to verify they are working? I’m glad you asked. I found a Network World post from 2005 that outlines the process: http:\/\/www.networkworld.com\/news\/2005\/041105-windows-crash.html<\/a>. You only need to download and install two applications (note: a few dependencies exist for these apps, such as the .NET Framework).<\/p>\n
    Download and Install Debugging Tools for Windows<\/a>
    \n    Download Windows Symbol Packages<\/a><\/p>\n
    These downloads are free and give you the tools to open\/review a crash dump. I don’t have the detailed understanding on how to work with these files, but I wanted to make sure the memory.dmp export worked correctly before sending an 8GB file to Microsoft for analysis.<\/p>\n","protected":false},"excerpt":{"rendered":"
    The other day I was assisting a co-worker who needed a memory dump of a Windows virtual machine. He was working with Microsoft support and the support engineer mentioned that the process for gathering this data was different since we … Continue reading →<\/span><\/a><\/p>\n","protected":false},"author":6,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"footnotes":""},"categories":[4],"tags":[],"class_list":["post-963","post","type-post","status-publish","format-standard","hentry","category-virtualization"],"_links":{"self":[{"href":"https:\/\/enterpriseadmins.org\/blog\/wp-json\/wp\/v2\/posts\/963","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/enterpriseadmins.org\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/enterpriseadmins.org\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/enterpriseadmins.org\/blog\/wp-json\/wp\/v2\/users\/6"}],"replies":[{"embeddable":true,"href":"https:\/\/enterpriseadmins.org\/blog\/wp-json\/wp\/v2\/comments?post=963"}],"version-history":[{"count":8,"href":"https:\/\/enterpriseadmins.org\/blog\/wp-json\/wp\/v2\/posts\/963\/revisions"}],"predecessor-version":[{"id":971,"href":"https:\/\/enterpriseadmins.org\/blog\/wp-json\/wp\/v2\/posts\/963\/revisions\/971"}],"wp:attachment":[{"href":"https:\/\/enterpriseadmins.org\/blog\/wp-json\/wp\/v2\/media?parent=963"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/enterpriseadmins.org\/blog\/wp-json\/wp\/v2\/categories?post=963"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/enterpriseadmins.org\/blog\/wp-json\/wp\/v2\/tags?post=963"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}