Thursday, March 18, 2010


Sometimes you would like to use your external USB drive to backup (transfer) your VMDK files directly from your ESX Server external USB drive. VMDK files are files with extention *.VMDK and those files are virtual hard disks of your virtual machines. You can also mount VMDK files directly into your Windows PC.

When you plug-in external USB drive to ESX host you need to enter some commands at the console. For those of you who don’t really know linux, there is some commands to remember. But they are not many…. -:) .

First of all you should know that not all filesystems are supported. For the supported ones there are those here:

* FAT32 read/write.
* Ext3 read/write
* NTFS read only (that means that you can’t use NTFS formated USB drives to copy your VMDK files, but you should create a partition with EXT3 or FAT32)

Now how-to copy data from Service Console to a USB device:

1. Plugin the external USB drive to your ESX host.
2. Run this command to find out to which device name the kernel assigned to it:

tail /var/log/dmesg

3. Now you will have to Run the following command to create a mount point (A mount point is a directory which a device or partition is attached to):

mkdir /mnt/usb


4. Run the following command to mount the drive ( When mounting, you must tell the mount command what is the device or partition you want to mount and what is the mount point. The mount point must be a directory that already exists on your system.:

mount /dev/[device_name] /mnt/usb -t [filesystem_type]

Please Note that you must:
* Replace [device_name] with your device name found in step 2
* Replace [filesystem_type] with vfat (FAT32) or ext3

5. After your copy(backup) you can type this command to unmount the device:

umount /dev/[device_name]

You might also want to export you VMDK files. Vmkstools is VMware ESX Server file system management tool. It is a program for creating and manipulating virtual disks, file systems, logical volumes and pyhsical storage device on the VMware ESX Server. Now what you need to do to export the VMDK (virtual disk)? You will use a command ‘vmfkstools’:

vmkfstools -i /vmfs/volumes/[datastore_name]/[vm_name]/[vm_name].vmdk /mnt/usb/[vm_name].vmdk -d 2gbsparse

And how-to import the VMDK (virtual disk):

vmkfstools -i /[path_to_USB_mount]/[vm_name].vmdk /vmfs/volumes/[datastore_name]/[vm_name]/[vm_name].vmdk

You might also want to copy the configuration files for a virtual machine. Those files are files with following extentions: *.vmx *.log *.nvram *.vmxf *.vmsd (you will not only copy the configuration files, but at the same time you will make a zip file in tar.gz format:

cd /vmfs/volumes/[datastore_name]/[vm_name]
tar -czvf [vm_name].tar.gz *.vmx *.log *.nvram *.vmxf *.vmsd
cp [vm_name].tar.gz /mnt/usb

Now you will be able to extract the configuration files of a virtual machine:

tar -xzvf [vm_name].tar.gz /vmfs/volumes/[datastore_name]/[vm_name]

Friday, March 5, 2010

Services.exe using up all your memory ? and windows hangs after launch?

I have faced an issue today, where one of the servers kept showing 100% CPU usage and after investigation it turned out to be services.exe taking up most of the cpu time.

After reading few forums, followed a suggestion by someone, to delete all logs from event logs.

This is the reasoning:

Whenever Windows recognises any failure either software/Hardware it makes a entry in the system log. And when you start your machine again this system log entry will be checked and Windows will try to search for a possible solution / or try to analyse the causes of failure.How to check this..

Click ctrl + alt + del – Open your task manager and click processes. And see how much memory the process services.exe is using, If it exceeds say 10%, you can be sure you are having the diagnostic problem.In the below picture the services.exe is running normally.

I did try the above option. and it did make a difference to the performance.
However, before i deleted the logs i found lot of the below warnings under app logs.

Event Type: Warning
Event Source: EvntAgnt
Event Category: None
Event ID: 3006
Date: 5/03/2010
Time: 10:17:13 AM
User: N/A
Error reading log event record. Handle specified is 691944. Return code from ReadEventLog is 87.

For more information, see Help and Support Center at