VM Related Files

When a virtual machine is created, several important files are generated in the location specified by the user.

The function or usage of the files can be determined by the file-extension assigned. However, some of the files created are only viewable from the command line or from certain other specialized views, but not everywhere uniformly, like in the Datastore browser.
The "-delta.vmdk" snapshot file as an example of this. This file does not display at all when simply browsing the datastore, versus when viewing the files from the command line, for example.

As of VMware ESXi 4 update 1 these files include:

Create:

File extension	Description
.vmxf	A configuration file for teaming features. Teaming is a feature used primarily with VMware workstation to allow administrators to logically group virtual machines for streamlined administration.
.vmx	The primary virtual machine configuration file. The .vmx file contains the bulk of the virtual machines settings, configuration, hardware support, and emulation features.
.vmsd	Virtual machine snapshot descriptor file. This empty file is created when you configure and generate a new virtual machine, and maintains information about the virtual machine's snapshots. The .vmsd file is a database of the virtual machine's snapshot information and the primary source of information for the snapshot manager. The file contains line entries, which define the relationships between snapshots as well as the child disks for each snapshot.
.vmdk	The virtual machine disk descriptor file contains disk geometry, layout, structure, and physical properties. The disk descriptor will describe an extent that represents the physical storage used by the disk. The term "file extent" refers to how many different fragments or "data runs" there are for a file. At most, a logical VMFS-3 volume can have 32 physical extents.
vmname-flat.vmdk	This file is considered a monolithic flat disk that has been fully allocated with the start and end markers allocated. This type of disk could potentially contain old data that resided on the data store if it is not properly cleared during the allocation of the disk. This type of disk is the default standard when setting up a virtual machine via the vSphere client on ESXi 4.0 update 1.

Files present after creation of the VM as seen in vSphere Datastore Browser, SSH Client and Web browser.

Startup:

Startup	Description
vmware.log vmware-#.log	VMware log files contain extensive diagnostic information, configuration and run-time messages of the virtual machine. Specifically, the vmware.log file holds detailed information about the virtual machine such as: network interfaces and corresponding IP addresses, hostname, ESXi kernel information, and detailed times in which snapshots were taken and restored. ESXi keeps the last 7 logfiles.
.nvram	The virtual machines Basic Input Output System (BIOS) settings can be found in the non-volatile random access memory file.
.vswp	A virtual machine swap file. When the virtual machine requires more memory to be allocated, the swap file will be used instead of physical memory even if its RAM setting is not overcommitted. As soon as the VM is started, a swap file for the VM is created. The swap file is created with the following format: vmname-[8 character hexadecimal number].vswp. In the examples shown, it was w2k3-server1-94480c5d.vswp and 512 MB in size. As of vSphere 5.0 there is yet another swap file present. This file is named vmx-[vmname-##########-#.vswp and it is created when the VM is started. In the examples shown it is vmx-w2k3-server-1415493640-1.vswp This file is to swap the vmkernel overhead for each VM. Historically the VMX process (VM execution support) on ESX is non-swappable. Memory reservation was used to back its virtual address-space, thereby ensuring that all populated virtual pages can be accomodated in physical memory. Since the entire VMX address-space does not have to be resident in memory, providing swap support will help in reducing the reservation requirements and will consequently also lower the VM's overall reserved overhead memory. Lowering per-VM reserved overhead memory will enable to run more VMs and/or larger VMs on a ESX host. This solution will also provide improved resistance from any errors in estimating VMX overhead memory, because such errors will no longer be fatal to the VM, as they used to be previously.

Files present after startup of the VM as seen in vSphere Datastore Browser, SSH Client and Web browser.

Suspend:

Resume:

Snapshot:

Snapshot	Description
vmname-######.vmsn	When a snapshot is taken from the VM, the previously empty .vmsd file will be populated with information about the new snapshot that is created. A .vmsn file is generated, containing memory contents for the virtual machine, however, this only happens if specified in the snapshot options menu of vSphere. Specifically, the .vmsn file contains "strings" of importance such as potential running process and hidden files that can be analyzed. Currently, commercially available (forensic) tools exist to compare snapshots of the same virtual machine to track the changes of altered or suspect files.
vmname-######.vmdk vmname-######-delta.vmdk	A collection of .vmdk and -delta.vmdk files for each virtual disk is connected to the virtual machine at the time of the snapshot. The vmname-######-delta.vmdk file stores the changes made to a virtual disk while the virtual machine is running. NOTE: The -number value might not be consistent across all child disks from the same snapshot. The file names are chosen based on filename availability.
vmname-aux.xml	This file is used to track the changes that occur during snapshot activities. Once the snapshot(s) are no longer present, this file can be (manually) deleted from storage.

Files present after snapshot of the VM as seen in vSphere Datastore Browser, SSH Client and Web browser.

Shutdown:

When a virtual machine is shutdown cleanly, the .vswp and .vmss files are deleted.
Files present after shutdown of the VM as seen in vSphere Datastore Browser, SSH Client and Web browser.

Changed Block Tracking (CBT):

vSphere 5 implements a CBT (changed block tracking) mechanism to track changed blocks of a virtual machine's disk, amongst others during backup operations of virtual machines.

This alleviates the burden from the backup applications having to scan or keep track of these changed blocks, resulting in much quicker incremental backups, because scanning of an entire virtual machine disk for changes since the last backup is no longer necessary.

Changed Block Tracking

Description

vmname-ctk.vmdk vmname-######-ctk.vmdk

The CBT feature stores information about changed blocks in a special -ctk.vmdk file that is created for each virtual disk file and snapshot disk file for which CBT is enabled. The filesize of the ctk-vmdk is static and does not grow past the initial size, unless the size of the virtual disks are changed. Based upon the filesize of the virtual disk that is tracked, the ctk.vmdk size is around .5 MB for every 10 GB of virtual disk size.

[ TOP ]