On Fri, Nov 23, 2018 at 20:08:13 +0530, Tanmoy Sinha wrote:
> Hi,
>
> I would like to get a clear picture on external snapshots memory dump (
> i.e. system-checkpoint) vs dumping the memory of the guest. I have created
> external snapshots which produces a disk file and a memory file. I am not
> able to use this memory file in any memory analysis tools, for instance
> volatility. However, the memory dump taken through "virsh dump" works just
> fine with such tools.
virsh dump allows to produce an elf-formatted memory image, while
snapshot uses the image in the qemu migration stream format so that it
can be restored.
> What am I missing here? The memory dump generated through external snapshot
> seems to be compressed, compared to the one generated by virsh dump. Can I
> specify the memory dump format in the snapshot XML?
The image is a 'libvirt-save-image' basically some headers followed by
the VM XML at the point when the image was taken and then followed by
the raw qemu migration stream (possibly compressed, depending on your
config in /etc/libvirt/qemu.conf). I presume the header is confusing
your memory analysis tool (if your tool is able to read qemu migration
stream image.)
No, the format of the memory image when doing snapshot is technically
internal implementation and can't be configured. For snapshots we need
it to be in a format that can be used to restore the VM again rather
than provide way for simple memory analysis.
Note that you can pause the VM and then take a snapshot (without memory,
just to freeze the disk contents) and then use virsh dump to use the
dump which is usable in your memory analyzer.