How to capture a vmcore of hung Red Hat Enterprise Linux VMware guest system with a snapshot or suspending VM

Solution Verified - Updated

Environment

  • Red Hat Enterprise Linux 4
  • Red Hat Enterprise Linux 5
  • Red Hat Enterprise Linux 6
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • VMware® Workstation 7.1
  • VMware® ESX/ESXi
  • VMware® "vmss2core" tool
  • vmcore
  • crash

Issue

  • RHEL server running on VMware hung or rebooted, need root cause analysis (RCA)
  • VM is hanging and unresponsive on vCenter console, how to troubleshoot?
  • How to capture a vmcore from RHEL VMware® guest system?
  • RHEL OS on VMWare has a high load or is not responding, how to capture core file for analysis

Resolution

Steps to capture a memory_snapshot of hung Red Hat Enterprise Linux VMware® guest system

  1. In the vSphere Client, right-click the guest system from the menu tree and choose one of the following options:

    • To take a snapshot: select Snapshot -> Take Snapshot -> Provide a name for the snapshot -> Ensure Snapshot the virtual machine's memory is checked (this may take some time to complete) -> Click Take snapshot.
    • To suspend the VM: select Power -> Suspend.

  2. Locate the files in the virtual machine directory and upload them to the case. Depending on your actions:

    • If you took a snapshot, there should be a file with a .vmsn suffix corresponding to the snapshot name.
    • If you suspended the VM and its virtual hardware version is:
      • 11 or newer, you should find two files: one with a .vmss suffix and another with a .vmem suffix.
      • 10 or older, collect only the .vmss file.

    Note: The size of the snapshot file (.vmsn), or the combined size of the suspend files (.vmss and .vmem, if applicable), should be as large as the total memory allocated to the virtual machine. If these files are significantly smaller (e.g., only a few kilobytes), you need to copy them to a different datastore type that is not a vSAN datastore.

Disclaimer: Links contained herein to external website(s) are provided for convenience only. Red Hat has not reviewed the links and is not responsible for the content or its availability. The inclusion of any link to an external website does not imply endorsement by Red Hat of the website or their entities, products or services. You agree that Red Hat is not responsible or liable for any loss or expenses that may result due to your use of (or reliance on) the external site or content.

Providing the snapshot or suspend files to Red Hat Support

  • Please provide the snapshot or suspend files directly to Red Hat Support for analysis

  • As stated right below, there is no need for converting these files anymore.

Crash utility supports VMware snapshot and suspend files directly

Manually converting snapshot files (for reference)

  • Although the manual conversion process is no longer required, the following steps outline the previous method for reference:

  • Notes:

    1. For RHEL4, vmss.core files converted from snapshots (.vmsn) could not be opened with the crash utility.
    2. For RHEL7, 8, and 9, provide the snapshot (.vmsn) or suspend file (.vmss) along with the .vmem file instead of converting it. KASLR (Kernel Address Space Layout Randomization) in kernels from RHEL 7.5 onwards may cause issues with debugging tools like crash. Refer to this article for more information.
    3. When a system panics the register state of each running CPU is saved to the task's stack. The crash tool can then use this information to determine the instruction and stack pointers at the time of the panic and display an accurate stack trace. VMWare snapshots or suspend images do not save the register state so crash will report erroneous stack traces for currently running tasks and debugging these tasks can be limited.

Steps to Manually Convert Snapshot Files

  1. VMware provides a tool called vmss2core to convert virtual machine checkpoints into core dump files.

  2. Following are some of the options available with the vmss2core tool to covert a snapshot (.vmsn) or suspend file (.vmss) into a suitable format to open it using Red Hat crash utility.

       -l <str>
   Specifies the starting and ending offsets of Linux kernel data structures for use by the -N and -P options, with <str> expressed as 0xHEXNUM,0xHEXNUM. Ignored when used with other options. You can determine the hexadecimal values in <str> by running the getlinuxoffsets debugger script. Source code for the script was posted to stackframe.blogspot.com in October 2007.

   -N
   Red Hat crash core file (vmss.core) for an arbitrary Linux version as defined by the -l option.

   -N4
   Red Hat crash core file (vmss.core) for Linux kernel version 2.4.

   -N6
   Red Hat crash core file (vmss.core) for Linux kernel version 2.6.

   -M
   Creates a core file ( vmss.core ) with a physical memory view suitable for the Gnu debugger gdb.

  3. Usage examples:

    • To create a vmss.core file:
    # vmss2core -N6 <vmName>.vmss
    • For a physical memory view:
    # vmss2core -M <vmName>.vmss

  4. Use the Red Hat crash utility or gdb to examine the core dump:

    # crash -s --machdep phys_base=0x200000 </path/to/vmlinux> </path/to/vmss.core>
SBR
Product(s)
Components
Category
Tags

This solution is part of Red Hat’s fast-track publication program, providing a huge library of solutions that Red Hat engineers have created while supporting our customers. To give you the knowledge you need the instant it becomes available, these articles may be presented in a raw and unedited form.