vmware esc crash dump tips

VMM Faults

A VMM fault is when the Virtual Machine Monitor sees a problem and halts operation

The guest OS and all VM supporting processes are also halted

This is analogous to a Virtual Hardware fault. This is similar to unplugging a server while it is running.

In some cases, VMM faults are a symptom of a problem with the host. If there is a SAN or other storage problem, it can manifest itself here.

In other cases, the problem can emanate from inside the VM i. e. bad or buggy hardware drivers within the VM

Review the logs from the PSOD dump

After the system is rebooted the core dump is placed in the /root directory

Use vmkdump –l to extract the vmkernel log from the core dump

A vmware-log.1 file is extracted from the dump

Near the end of this file you will be able to see what had happened on the system

Troubleshooting Strategies - Hangs

Whether the hang occurs at the VM level or at the host level, these steps will help

Check the console for inactivity

Ping the host or VM for a response

Monitor network traffic from outside the VM or host

(VM only) Monitor performance statistics of the VM from the host to see if it is consuming a lot of resources

(VM only) Run vm-support –s –i 10 –d 15 to collect performance statistics and logs

(VM only) Run vm-support –X to kill the VM, generate core dumps of the VM and collect logs

(Host only) Increase BIOS watchdog timers to see if the system will return to normal operation

(Host only) Disable watchdog timers and see if any other symptoms arise

In addition to the Web server, the following processes and services involved in the management of an ESX Server system run in the service console:

• Server daemon (vmserverd) — Performs actions in the service console on behalf of the VMware Remote Console and the Web-based VMware Management Interface.
• Authentication daemon (vmauthd) — Authenticates remote users of the management interface and remote consoles using the username/password database. Any other authentication store that can be accessed using the Pluggable Authentication Module (PAM) capabilities present in the service console may also be used. This permits the use of passwords from a Windows domain controller, LDAP or RADIUS server, or similar central authentication store to be used with VMware ESX Server for remote access.
• SNMP server (ucd-snmpd) — Implements the SNMP data structures and traps an administrator can use to integrate an ESX Server system into an SNMP-based system management tool.
• In addition to these VMware-supplied services, the service console can be used to run other system wide or hardware-dependent management tools. These include hardware-specific health monitors (such as IBM Director, HP Insight Manager and others), full-system backup and disaster recovery software, and clustering and high availability products.

The server and virtual machine resources and configuration attributes that are available through the SNMP and HTTP interfaces are also visible through a file system in the service console. The files in this /proc/vmware name space may be examined and modified by users logged in to the service console with sufficient permissions or may be used as a point of integration for home-grown or commercial scripts and management tools.

Promiscuous mode

From Wikipedia, the free encyclopedia

In computing, promiscuous mode or promisc mode is a configuration of a network card that makes the card pass all traffic it receives to the central processing unit rather than just packets addressed to it — a feature normally used for packet sniffing.

Each packet includes the hardware (Media Access Control) address. When a network card receives a packet, it normally drops it unless the packet is addressed to that card. In promiscuous mode, however, the card allows all packets through, thus allowing the computer to read packets intended for other machines or network devices.

Many operating systems require superuser privileges to enable promiscuous mode. A non-routing node in promiscuous mode can generally only monitor traffic to and from other nodes within the same collision domain (forEthernet and Wireless LAN) or ring (for Token ring or FDDI). Computers attached to the same network hub satisfy this requirement, which is why network switches are used to combat malicious use of promiscuous mode. A routermay monitor all traffic that it routes.

Promiscuous mode is often used to diagnose network connectivity issues. There are programs that make use of this feature to show the user all the data being transferred over the network. Some protocols like FTP and Telnet transfer data and passwords in clear text, without encryption, and network scanners can see this data. Therefore, computer users are encouraged to stay away from insecure protocols like telnet and use more secure ones such as SSH.

Promiscuous mode is also used by transparent network bridges in order to capture all traffic that needs to pass the bridge so that it can be retransmitted on the other side of the bridge.