Creating core dumps to help analyze VirtualBox crashes

A core dump is a technical term for a file containing detailed information about the state of an application at a given time, in a form which developers can make use of. They are particularly helpful for tracking down the reasons for application crashes, which is why many systems can be told to create one automatically when an application crash occurs.

How to create a core dump on Linux

VirtualBox is (as of version 2.0.0) a system application which can be started from a user account without special privileges - a so-called "setuid" application. As core dumps are usually not allowed for these sensitive applications you have to explicitly allow them after starting your computer but before the crash which you want a core dump from. This can be done by typing the following command at the command line (your user account must be allowed to use the "sudo" command):

$ echo -n 1 | sudo tee /proc/sys/fs/suid_dumpable

The procedure for actually creating a core dump is similar on most Linux systems, but on Ubuntu it is slightly different due to the Ubuntu crash reporting tool (Apport).

To create a core dump on an Ubuntu system

create a file called ".config/apport/settings" in your home directory with the contents

[main]
unpackaged=true

and run VirtualBox. Any crashes of VirtualBox after you have created the file will cause a crash report to be created in /var/crash with a name like "_usr_lib_virtualbox_VirtualBox.1000.crash". Do not accept the offer to "Send an error report to help fix this problem". You can extract the core file using the "apport-unpack" tool, or if you are unsure you can just send us the full crash report file. To stop crash files being created for non-system applications delete the file that you created again.

To create a core dump on non-Ubuntu systems

start VirtualBox from a command line (e.g. xterm):

$ ulimit -c unlimited
$ echo -n 1 | sudo tee /proc/sys/fs/suid_dumpable
$ VirtualBox

or if possible start the virtual machine directly:

$ ulimit -c unlimited
$ echo -n 1 | sudo tee /proc/sys/kernel/core_uses_pid
$ /usr/lib/virtualbox/VirtualBox -startvm VM_NAME

Ensure that no startup script (~/.bashrc, ~/.bash_profile, ~/.profile) contains an instruction like ulimit -c 0 as the limit cannot be increased once it was set to zero.

When VirtualBox or one of its processes crashes, a file core.<pid> is created in the current directory. Be aware that core dumps can be very huge. Please compress the file before submitting it to a bug report. Or better don't attach the file to a report. Note that this core dump can contain a memory dump of your guest which can include sensitive information. Send it to frank _dot_ mehnert _at_ oracle _dot_ com if the compressed file is smaller than 5MB. Upload it to ftp.oracle.com:/appsdev/incoming and contact me directly otherwise to tell me the file name of the uploaded core dump.

If several core files are created, you can check which process created them using the command

$ file core.<pid>

to be sure of the right one to send.

How to create dumps on Mac OS X

To create a core dump on Mac OS X, start VirtualBox from a command line:

$ ulimit -c unlimited
$ VirtualBox

or better start the VM directly:

$ ulimit -c unlimited
$ /Applications/VirtualBox.app/Contents/MacOS/VirtualBox -startvm VM_NAME

Ensure that no startup script (~/.bashrc, ~/.bash_profile, ~/.profile) contains an instruction like ulimit -c 0 as the limit cannot be increased once it was set to zero.

Alternatively (for Finder & launchpad)

$ launchctl limit core unlimited

or for permanent effect the same could be specified in $HOME/.launchd.conf or /etc/launchd.conf.

The core files can be found in the /cores folder. That directory must be writable by the program that's dumping core. By default, it is only writable by root and by users in the admin group. If you need normal users to be able to dump a core, you can make the directory world writable with the command:

$ sudo chmod o+w /cores

How to create dumps on Solaris

To enable core dumps on Solaris, run the following command as root

# coreadm -g /var/cores/core.%f.%p -i core.%f.%p \
  -e global -e process -e global-setid -e proc-setid -e log

The cores would end up in /var/cores/ folder. Global dumps would end up in /var/crash/<hostname>/

System core dumps need to be enabled via dumpadm. The important thing is to have "Savecore enabled" to "yes" (use dumpadm -y). The configuration should look something like this:

# dumpadm
      Dump content: kernel pages
       Dump device: /dev/zvol/dsk/rpool/dump (dedicated)
Savecore directory: /var/crash/myhostname
  Savecore enabled: yes
   Save compressed: on

Now to obtain a core dump for the VM process, run:

VBoxManage startvm <vmname>

Forcing VirtualBox to terminate with a core dump

Sometimes it is required to force a VirtualBox process to terminate, for example, a VM hangs for some unknown reason. On Linux, this can be done as follows:

$ ulimit -c unlimited
$ sudo echo -n 1 > /proc/sys/fs/suid_dumpable
$ /usr/lib/virtualbox/VirtualBox -startvm VM_NAME &
$ pidof VirtualBox
7145
$ kill -4 7145

As an alternative to kill you can do

$ pidof VirtualBox
7145
$ gcore 7145

On Mac OS X:

$ ulimit -c unlimited
$ /Applications/VirtualBox.app/Contents/MacOS/VirtualBox -startvm VM_NAME &
$ ps aux|grep VirtualBox
... 7145 ... VirtualBox ...
$ kill -4 7145

On Solaris:

# ulimit -c unlimited
# /opt/VirtualBox/amd64/bin/VirtualBox -startvm VM_NAME &
# ps -ef|grep VirtualBox
... 7145 ... VirtualBox ...
# kill -4 7145

You can find result core file according location specified in coreadm

# coreadm

Passing the signal number 4 (SIGILL) is essential! The same applies to the alternative frontends VBoxHeadless and VBoxSDL.

Minidumps on Windows

On Windows so-called Mini Dumps are available for application crashes and/or investigating purposes. To enable creating such Mini Dumps for a specific application, Windows offers the following tools:

• For Windows XP, Vista, 7, 8(.1) and Windows 10: Windows Error Reporting (WER)
• For older Windows versions such as Windows NT 4 or Windows 2000: Dr. Watson. VirtualBox is not supported on these platforms anymore.

If you got a BSOD (Bluescreen) instead, meaning that your PC was unable recover and needed to be restarted as soon as you used VirtualBox, you need to get a kernel dump instead.

Enabling Mini Dumps using Windows Error Reporting (WER)

• Open up the regedit.exe as Administrator and create the key

  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\Windows Error Reporting\LocalDumps
  

  if it does not exist yet.

• Create a registry REG_DWORD value named DumpType with a value of 2 (means full dump).
• Create a registry REG_SZ value named DumpFolder containing a path to a folder where to store the Mini Dumps, e.g. C:\Windows\Temp.

The next time VirtualBox crashes you'll find a newly created Mini Dump in the folder you specified above. Before sending those Mini Dumps to us though, please first compress them with ZIP (e.g. 7zip) or RAR to reduce the overall file size. This also saves you time uploading this file!

For more detailed information visit ​this page.

Using the Process Explorer

The process explorer (Windows Sysinternals) allows to create a minidump or a full application dump using the context menu. Of course this helps only if the process didn't terminate due to a crash.

Creating a kernel dump when a Bluescreen (BSOD) occurred

Windows automatically should create a kernel dump for you if a Bluescreen occurred. However, you might want to enable creating a more verbose kernel dump which then would help us a bit better.

To do so, go (as Administrator) to the System failure settings by

Start -> Control Panel -> System -> Advanced system settings (left side) -> Tab "Advanced" -> "Startup and Recovery"

On this page in the System failure area you can change the "Write debugging information" to Kernel memory dump. The Dump file path shows you where this file is being created then -- the default location is C:\Windows\MEMORY.DMP.

Please also be aware that each time a Bluescreen occurred the file mentioned above will be overwritten! This means that you should copy this file to a save place to not lose it if you want to provide us the right information. Also, other applications on your PC may produce Bluescreens, so only send us the kernel dump which got created when directly using VirtualBox (and your PC showed a Blueescreen).

Note: Before sending those kernel dumps to us though, please first compress them with ZIP (e.g. 7zip) or RAR to reduce the overall file size. This also saves you time uploading this file!

Privacy information: Also be aware that the above kernel dumps could contain unrelated sensitive and private information about you and your system, e.g. stored passwords in memory. Unfortunately this is unavoidable in those situations, as a kernel dump essentially is an unmodified and unfiltered part of your computer's RAM (main memory).