The ESXi-host is active in production.
A VMFS- datastore has a problem like:
– can not be mounted
– a directory or a file is suddenly missing
– a vmdk can not be used because of I/O errors
– other “strange effects”
The datastore can be active and there is no need to shutdown any VMs first.
Prepare the Linux-system
The Linux-system can be launched
– on a physical host
– as a VM on any other ESXi/Workstation-host
– as a VM on the target ESXi-host
– the moa.iso Linux LiveCD
– network connection to the target ESXi
– if it is a VM assign at least 4 GB RAM, 2 CPUs or better and use a network that can access the IP of the target ESXi-host
– a VMDK is only necessary for extensive analysis
Create the VMFS-meta-data dump
After the Linux-system has finished booting and the network is up you can access it via putty or WinSCP
user: root – password: sanbarrow
create a directory:
connect to the target ESXi-host
sshfs -o ro root@ip-of-esxi:/ /esxi
check the list of devices that are in use by the target ESXi
ls -lah | grep -v vml
You should now be able to identify the target VMFS-volume
Dump the first 1536 MB of the 3rd partition if the VMFS-volume is part of the ESXi-boot disk
dd if=name-vmfs-partition:3 bs=1M count=1536 of=/tmp/name-vmfs-dump.1536
Dump the first 1536 MB of the 1st partition if the VMFS-volume is on a disk of its own.
dd if=name-vmfs-partition:1 bs=1M count=1536 of=/tmp/name-vmfs-dump.1536
To analyse the partitiontable dump the first 1 MB of the disk
dd if=name-vmfs-disk bs=1M count=1 of=/tmp/name-vmfs.disk
( Edit the lines above and use appropriate file names. )
If that worked you can download the dump-file with WinSCP .
Delete the dump after you downloaded it from /tmp to keep free space in /tmp available.