vSphere: How to Decrypt Encrypted Zdump Files After a PSOD and Create a Support Bundle

Summary: vSphere 7.x and later ESXi host experiences a Purple Screen of Death (PSOD) creates a Zdump core dump that is auto‑encrypted. This happens when the host is using Virtual Machine encryption. ...

This article applies to This article does not apply to This article is not tied to any specific product. Not all product versions are identified in this article.
Check out other resources

Instructions

Decrypt Core Dump Files and Create Support Bundle.

Prerequisites

  • SSH access to the ESXi host that experienced the PSOD.
  • vSphere version 7.x or later

Procedure

  • Connect to the affected ESXi host via SSH.
  • Check whether each core dump in /var/core is encrypted.
  • If encrypted, decrypt the core dump file.
  • Create a new support bundle.
  • Upload the support bundle directly to the case for analysis 

Step‑by‑Step Commands

# SSH to the ESXi host
$ ssh root@[ESXI_HOST_IP]

# Verify encryption status of the first core dump
crypto-util envelope describe --offset 4096 /var/core/vmkernel-zdump.1

# Decrypt the first core dump if it is encrypted
crypto-util envelope extract --offset 4096 /var/core/vmkernel-zdump.1 /var/core/unenc-vmkernel-zdump.1

# Decrypt additional core dump files (repeat for each .zdump file)
crypto-util envelope extract --offset 4096 /var/core/vmkernel-zdump.2 /var/core/unenc-vmkernel-zdump.2

# Create a new support bundle
vm-support
vm-support -w use the -w to specify loaction example: ( vm-support -w /vmfs/volume/DATASTORE_NAME )
# The default bundle location is:
/var/tmp/ /var/log/ depending on which loacation has the most space
Caution: Decrypting core dumps may expose sensitive customer data. Handle the unencrypted files securely and delete them after the support bundle is created.

Affected Products

VxRail, VMware ESXi 7.x, VMware ESXi 8.x, VMware ESXi 9.x, VMware OEM Products with ProSupport, VMware VSAN, VxRail Appliance Series, VxRail Software
Article Properties
Article Number: 000393489
Article Type: How To
Last Modified: 19 ذو القعدة 1447
Version:  3
Find answers to your questions from other Dell users
Support Services
Check if your device is covered by Support Services.