More Thoughts on Forensics
I mentioned in my last blog that it would be handy to get a copy of all the VMs datafiles as they contain memory files.
The best way to preserve these files is to power off the VM as if you were pulling the plug on the VM. There are several ways to accomplish this task.
The first is to pull the power on the entire ESX server. Not always desirable but it is done from time to time.
The other more appropriate way is to kill the process running the VM, however that is quite a bit of trouble. You are first required to find the VMID of the VM and then to find its parent VMID and finally kill the VM within the vmkernel. This is achieved by doing:
VMID=`/usr/bin/vm-support -x | grep VMName|awk '{print $1}'|awk -F= '{print $2}`
KVMID=`cat /proc/vmware/vm/$VMID/cpu/status |awk '{print 21}'|grep -v group|awk -F\. '{print $2}'`
/usr/lib/vmware/bin/vmkload_app -k 19 $KVMID
These steps will kill the VM while maintaining a copy of the virtual swap file. If the VM had to swap to disk, the data is now there for you to use in your investigations.
However, it is always best to remember that this file is not always used.
Build your tech library with our book giveaways.
Windows PowerShell 2.0 Unleashed
By Tyson Kopczynski, Pete Handley, Marco Shaw; Published by Sams
Windows PowerShell Unleashed will not only give you deep mastery over PowerShell but also a greater understanding of the features being introduced in PowerShell 2.0–and show you how to use it to solve your challenges in your production environment. Enter now!
Ubuntu Server Administration
By Michael Jang; Published by McGraw-Hill Osborne Media
Realize a dynamic, stable, and secure Ubuntu Server environment with expert guidance, tips, and techniques from a Linux professional. Ubuntu Server Administration covers every facet of system management -- from users and file systems to performance tuning and troubleshooting. Enter now!
Pulling the plug, I like it
Pulling the plug, I like it :O the command for killing the guest is very useful.once again an excellent blog. keep them coming.
This is a pretty good way to
This is a pretty good way to find the process you need to kill if a VM hangs. If you decide to use the commands Ed posted, just change "VMName" to the actual VM name, then fix the close parentheses at the end of line 1 and add the "$" to the '{print 21}' for line 2, so it looks like '{print $21}'.I just popped that into a "KillVM.sh" script and use it to nix any pesky hung VMs. I also changed the "vmkload_app -k 19" to "vmkload_app -k 9" so it will do a kill -9 which is signal 9 KILL (non-catchable, non-ignorable kill).
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
# KillVM script
#
# Usage: "killVM.sh
#
VMID=`/usr/bin/vm-support -x | grep VMName|awk '{print $1}'|awk -F= '{print $2}'`
KVMID=`cat /proc/vmware/vm/$VMID/cpu/status |awk '{print $21}'|grep -v group|awk -F\. '{print $2}'`
/usr/lib/vmware/bin/vmkload_app -k 9 $KVMID