How open a vmkernel-zdump

[mancio]

Hi all..

How can I open a vmkernel-zdump dump??

thanks

Matteo

[dominic7]

Not all of it is readable by human eyeballs. And VMware doesn't hand out tools to analyze the memory dump.

What I do is transfer the file to a windows host and use Notepad++ ( free ) to open it as a standard text file. Then you can check and see why the host crashed. I've been doing a lot of this lately unfortunately. Assuming it's a hardware problem, you can look for machine check exceptions like this one:

[31;1m3:04:56:52.344 cpu3:1156)ALERT: MCE: 147: Machine Check Exception [0m

[31;1m3:04:56:52.344 cpu3:1156)ALERT: MCE: 160: Machine Check Exception: General Status 0000000000000004 [0m

[31;1m3:04:56:52.344 cpu3:1156)ALERT: MCE: 171: Machine Check Exception: Bank 0, Status 0000000000000000 [0m

[31;1m3:04:56:52.344 cpu3:1156)ALERT: MCE: 171: Machine Check Exception: Bank 1, Status 0000000000000000 [0m

[31;1m3:04:56:52.344 cpu3:1156)ALERT: MCE: 171: Machine Check Exception: Bank 2, Status 0000000000000000 [0m

[31;1m3:04:56:52.344 cpu3:1156)ALERT: MCE: 171: Machine Check Exception: Bank 3, Status 0000000000000000 [0m

[31;1m3:04:56:52.344 cpu3:1156)ALERT: MCE: 171: Machine Check Exception: Bank 4, Status f66da00125080813 [0m

[31;1m3:04:56:52.344 cpu3:1156)ALERT: MCE: 188: Machine Check Exception: Bank 4, Addr 000000070b234600 [0m

3:04:56:52.344 cpu3:1156)Backtrace for current CPU #3, worldID=1156, ebp=0x3613ef0

3:04:56:52.344 cpu3:1156)0x3613ef0:\[0x61f118]_vLog+0x0(0x789ce0, 0x3613f0c, 0x3613f3c, 0x653bed, 0x789ce0)

3:04:56:52.344 cpu3:1156)0x3613f00:\[0x61f118]_vLog+0x0(0x789ce0, 0xbc, 0x4, 0x7, 0xb234600)

3:04:56:52.344 cpu3:1156)0x3613f3c:\[0x653bed]MCE_Handle_Exception+0x179(0x1948cb, 0x0, 0x1948cb, 0x0, 0x0)

3:04:56:52.344 cpu3:1156)0x3613fb0:\[0x61bbfa]IDT_VMMIntOrMCE+0x66(0x2d, 0x5ac0, 0x61d3b4, 0x3614000, 0x111b1021)

3:04:56:52.345 cpu3:1156)0x3613fe8:\[0x61d43e]VMKCall+0x8a(0x2d, 0x5ac0, 0x1046, 0x5a84, 0x0)

[45m [33;1mVMware ESX Server \[Releasebuild-43424] [0m

Machine Check Exception: Unable to continue

-Dominic

[mancio]

Ok...I've opened it with less command, but some parts (as you write) are not human readable..so I've stared this thread..

I've tryed gdb from a *nix box too, but no g00d.

Thanks

Matteo

Message was edited by:

mancio

[gsilver]

(you probably only care about the last step, but for those who haven't gotten that far...)

If you don't have a vmkernel-zdump in /root, you'll need to retrieve it first. Look at your disk and find the "Unknown" partition (in my case /dev/cciss/c0d0p9):

fdisk -l /dev/cciss/c0d0

Disk /dev/cciss/c0d0: 146.7 GB, 146778685440 bytes 255 heads, 63 sectors/track, 17844 cylinders Units = cylinders of 16065 * 512 = 8225280 bytes

Device Boot Start End Blocks Id System /dev/cciss/c0d0p1 * 1 65 522081 83 Linux /dev/cciss/c0d0p2 66 1370 10482412+ 83 Linux /dev/cciss/c0d0p3 1371 1631 2096482+ 82 Linux swap /dev/cciss/c0d0p4 1632 17844 130230922+ f Win95 Ext'd (LBA) /dev/cciss/c0d0p5 1632 1892 2096451 83 Linux /dev/cciss/c0d0p6 1893 2153 2096451 83 Linux /dev/cciss/c0d0p7 2154 2414 2096451 83 Linux /dev/cciss/c0d0p8 2415 2479 522081 83 Linux /dev/cciss/c0d0p9 2480 2493 112423+ fc Unknown

Then get the dump:

vmkdump -d /dev/cciss/c0d0p9

Then dump the binary dump to a useful log:

vmkdump -l vmkernel-zdump.1

Then you can analyze it:

tail -20 vmkernel-log.1

gen 58345, mode 1, owner 48514c80-7f2f5fbb-096a-001f29cd2f0c mtime 673186] 7:19:00:56.490 cpu0:1036)FS3: 1974: Checking if lock holders are live for lock [type 10c00002 offset 13008896 v 186010, hb offset 3521536 gen 58351, mode 1, owner 48514c80-7f2f5fbb-096a-001f29cd2f0c mtime 673495] VMware ESX Server Exception type 14 in world 1158:vmm3:lx-chmv @ 0x659448 frame=0x3c1be90 ip=0x659448 cr2=0x405fe008 cr3=0x4900b000 cr4=0x660 es=0x4040 ds=0x4040 fs=0x0 gs=0x4041 eax=0x409fe000 ebx=0x409fe000 ecx=0xfff edx=0x409fe000 ebp=0x3c1bef8 esi=0x2a edi=0x0 err=9 eflags=0x11206 0:1024/console 1:1157/vmm2:lx-c *2:1158/vmm3:lx-c 3:1156/vmm1:lx-c 4:1124/vmm1:lx-c 5:1123/vmm0:lx-c 6:1125/vmm2:lx-c 7:1126/vmm3:lx-c @BlueScreen: Exception type 14 in world 1158:vmm3:lx-chmv @ 0x659448 0x3c1bef8:[0x659448]Hash_Page+0x3b stack: 0x409fe000, 0xfff, 0x1000 0x3c1bf18:[0x6598da]PShare_HashPage+0x39 stack: 0xffffffff, 0x1, 0x6069c2 0x3c1bf3c:[0x601f28]AllocCOWUpdateP2MDone+0x17 stack: 0x40406b10, 0x7, 0x1000 0x3c1bf84:[0x606a6a]Alloc_COWCopyPage+0x1a1 stack: 0xb, 0x830000c0, 0x8c17d60 0x3c1bfd8:[0x622465]VMKCall+0x12c stack: 0xb, 0x8c17d60, 0x830000c0 0x3c1bffc:[0x67aceb]VMKVMMEnterVMKernel+0x8e stack: 0x0, 0x0, 0x0 VMK uptime: 7:20:09:42.103 TSC: 1905467644161975 Starting coredump to disk Starting coredump to disk Dumping using slot 1 of 1... using slot 1 of 1... log