How to convert a VMware virtual machine snapshot to a memory dump
Last Updated May 18, 2018
How to capture a memory dump from a VMware virtual machine without stopping its execution. This is useful in cases where customers do not want to force a crash or change Windows dump parameters and reboot the machine. This procedure can be done without interrupting the execution of the machine.
How to capture a memory dump from a VMware virtual machine
When the VM hangs, crashes, or otherwise displays symptoms you are troubleshooting, then go into VMware vCenter, Workstation, or Fusion interface and take a snapshot. You may also choose to suspend the VM.
Browse to the file location where the VM is located. This may vary depending on the VMware product you are using. Within VCenter, you can do this in VM properties by right clicking and browsing the datastore where the VM is located.
Locate the folder with the same name as the VM.
Inside the folder, locate the snapshot files. There will be a snapshot (.vmsn) or suspend file (.vmss) in the virtual machine directory, and a non‐monolithic memory (.vmem) file, all with the same base name e.g. servername-Snapshot3 with different suffixes (vmsn, vmss, and/or vmem). If there are different snapshots, e.g. servername-Snapshot1, 2, 3, etc then locate the correct files for your recent snapshot or suspension by examining time/date stamps.
Save a copy of all files that are present (.vmsn, .vmss, and .vmem) for your snapshot. In vCenter you can right click on the files and choose Download and save them to the local machine. Zip them up and send them to Symantec Support.
The following steps are for the customer's information only -- it is not necessary to perform them; Symantec support can convert the snapshot files themselves.