= Creating core dumps to help analyze VirtualBox crashes = A core dump is a technical term for a file containing detailed information about the state of an application at a given time, in a form which developers can make use of. They are particularly helpful for tracking down the reasons for application crashes, which is why many systems can be told to create one automatically when an application crash occurs. = How to create a core dump on Linux = #Linux !VirtualBox is (as of version 2.0.0) a system application which can be started from a user account without special privileges - a so-called "setuid" application. As core dumps are usually not allowed for these sensitive applications you have to explicitly allow them after starting your computer but before the crash which you want a core dump from. This can be done by typing the following command at the command line (your user account must be allowed to use the "sudo" command): {{{ $ echo -n 1 | sudo tee /proc/sys/fs/suid_dumpable }}} == To create a core dump on a SUSE system == #SUSE [https://www.suse.com/support/kb/doc/?id=3054866][[BR]] The procedure for actually creating a core dump is similar on most Linux systems, but on Ubuntu it is slightly different due to the Ubuntu crash reporting tool (Apport). == To create a core dump on an Ubuntu system == #Ubuntu create a file called ".config/apport/settings" in your home directory with the contents {{{ [main] unpackaged=true }}} and run !VirtualBox. Any crashes of !VirtualBox after you have created the file will cause a crash report to be created in /var/crash with a name like "_usr_lib_virtualbox_VirtualBox.1000.crash". Do not accept the offer to "Send an error report to help fix this problem". You can extract the core file using the "apport-unpack" tool, or if you are unsure you can just send us the full crash report file. To stop crash files being created for non-system applications delete the file that you created again. == To create a core dump on non-Ubuntu systems == #OtherLinux start !VirtualBox from a command line (e.g. xterm): {{{ $ ulimit -c unlimited $ echo -n 1 | sudo tee /proc/sys/fs/suid_dumpable $ VirtualBox }}} or if possible start the virtual machine directly: {{{ $ ulimit -c unlimited $ echo -n 1 | sudo tee /proc/sys/kernel/core_uses_pid $ /usr/lib/virtualbox/VirtualBox -startvm VM_NAME }}} Ensure that '''no''' startup script (`~/.bashrc`, `~/.bash_profile`, `~/.profile`) contains an instruction like `ulimit -c 0` as the limit cannot be increased once it was set to zero. When !VirtualBox or one of its processes crashes, a file core. is created in the current directory. Be aware that core dumps can be very huge. Please compress the file before submitting it to a bug report. Or better don't attach the file to a report. Note that this core dump can contain a memory dump of your guest which can include sensitive information. Send it to alexander _dot_ eichner _at_ oracle _dot_ com if the compressed file is smaller than 5MB. Contact me directly otherwise so we can look for another solution to get the core dump to us. If several core files are created, you can check which process created them using the command {{{ $ file core. }}} to be sure of the right one to send. = How to create dumps on Mac OS X = #OSX To create a core dump on Mac OS X, start !VirtualBox from a command line: {{{ $ ulimit -c unlimited $ VirtualBox }}} or better start the VM directly: {{{ $ ulimit -c unlimited $ /Applications/VirtualBox.app/Contents/MacOS/VirtualBox -startvm VM_NAME }}} Ensure that '''no''' startup script (`~/.bashrc`, `~/.bash_profile`, `~/.profile`) contains an instruction like `ulimit -c 0` as the limit cannot be increased once it was set to zero. Alternatively (for Finder & launchpad) {{{ $ launchctl limit core unlimited }}} or for permanent effect the same could be specified in $HOME/.launchd.conf or /etc/launchd.conf. The core files can be found in the /cores folder. That directory must be writable by the program that's dumping core. By default, it is only writable by root and by users in the admin group. If you need normal users to be able to dump a core, you can make the directory world writable with the command: {{{ $ sudo chmod o+w /cores }}} = How to create dumps on Solaris = #Solaris To enable core dumps on Solaris, run the following command as root {{{ # coreadm -g /var/cores/core.%f.%p -i core.%f.%p \ -e global -e process -e global-setid -e proc-setid -e log }}} The cores would end up in /var/cores/ folder. Global dumps would end up in /var/crash// System core dumps need to be enabled via dumpadm. The important thing is to have "Savecore enabled" to "yes" (use `dumpadm -y`). The configuration should look something like this: {{{ # dumpadm Dump content: kernel pages Dump device: /dev/zvol/dsk/rpool/dump (dedicated) Savecore directory: /var/crash/myhostname Savecore enabled: yes Save compressed: on }}} Now to obtain a core dump for the VM process, run: {{{ VBoxManage startvm }}} = Forcing !VirtualBox to terminate with a core dump = #Forcing Sometimes it is required to force a !VirtualBox process to terminate, for example, a VM hangs for some unknown reason. On Linux, this can be done as follows: {{{ $ ulimit -c unlimited $ sudo echo -n 1 > /proc/sys/fs/suid_dumpable $ /usr/lib/virtualbox/VirtualBox -startvm VM_NAME & $ pidof VirtualBox 7145 $ kill -4 7145 }}} As an alternative to ''kill'' you can do {{{ $ pidof VirtualBox 7145 $ gcore 7145 }}} On Mac OS X: {{{ $ ulimit -c unlimited $ /Applications/VirtualBox.app/Contents/MacOS/VirtualBox -startvm VM_NAME & $ ps aux|grep VirtualBox ... 7145 ... VirtualBox ... $ kill -4 7145 }}} On Solaris: {{{ # ulimit -c unlimited # /opt/VirtualBox/amd64/bin/VirtualBox -startvm VM_NAME & # ps -ef|grep VirtualBox ... 7145 ... VirtualBox ... # kill -4 7145 }}} You can find result core file according location specified in coreadm {{{ # coreadm }}} Passing the signal number 4 (`SIGILL`) is essential! The same applies to the alternative frontends `VBoxHeadless` and `VBoxSDL`. = Minidumps on Windows = #WindowsMiniDumps On Windows so-called Mini Dumps are available for '''application crashes''' and/or investigating purposes. To enable creating such Mini Dumps for a specific application, Windows offers the following tools: - For Windows XP, Vista, 7, 8(.1) and Windows 10: '''Windows Error Reporting (WER)''' - For older Windows versions such as Windows NT 4 or Windows 2000: '''Dr. Watson'''. VirtualBox is not supported on these platforms anymore. If you got a '''BSOD (Bluescreen)''' instead, meaning that your PC was unable recover and needed to be restarted as soon as you used VirtualBox, you need to get a '''kernel dump''' instead. == Enabling Mini Dumps using Windows Error Reporting (WER) == * Open up the regedit.exe as Administrator and create the key {{{ HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps }}} if it does not exist yet. * Create a registry REG_DWORD value named '''DumpType''' with a value of '''2''' (means full dump). * Create a registry REG_SZ value named '''DumpFolder''' containing a path to a folder where to store the Mini Dumps, e.g. '''C:\Windows\Temp'''. The next time VirtualBox crashes you'll find a newly created Mini Dump in the folder you specified above. Before sending those Mini Dumps to us though, please first compress them with ZIP (e.g. 7zip) or RAR to reduce the overall file size. This also saves you time uploading this file! For more detailed information visit [http://social.technet.microsoft.com/wiki/contents/articles/8103.application-crash-dump-analysis-windows-7.aspx this] page. == Using the Process Explorer == The process explorer (Windows Sysinternals) allows to create a minidump or a full application dump using the context menu. Of course this helps only if the process didn't terminate due to a crash. == Creating a kernel dump when a Bluescreen (BSOD) occurred == #WindowsBSODs Windows automatically should create a kernel dump for you if a Bluescreen occurred. However, you might want to enable creating a more verbose kernel dump which then would help us a bit better. To do so, go (as Administrator) to the '''System failure''' settings by {{{ Start -> Control Panel -> System -> Advanced system settings (left side) -> Tab "Advanced" -> "Startup and Recovery" }}} On this page in the '''System failure''' area you can change the "Write debugging information" to '''Kernel memory dump'''. The '''Dump file''' path shows you where this file is being created then -- the default location is '''C:\Windows\MEMORY.DMP'''. Please also be aware that each time a Bluescreen occurred the file mentioned above will be '''overwritten'''! This means that you should copy this file to a save place to not lose it if you want to provide us the right information. Also, other applications on your PC may produce Bluescreens, so only send us the kernel dump which got created when directly using VirtualBox (and your PC showed a Blueescreen). Note: Before sending those kernel dumps to us though, please first compress them with ZIP (e.g. 7zip) or RAR to reduce the overall file size. This also saves you time uploading this file! '''Privacy information''': Also be aware that the above kernel dumps could contain unrelated '''sensitive and private information''' about you and your system, e.g. stored passwords in memory. Unfortunately this is unavoidable in those situations, as a kernel dump essentially is an unmodified and unfiltered part of your computer's RAM (main memory).