Re: [Qemu-devel] Taking live snapshots of running VMs

[Stefan Hajnoczi]

On Fri, Jul 8, 2011 at 11:24 PM, Ahmed M. Azab <address@hidden> wrote:
> Is there a way to take a live memory snapshot of a running VM without
> freezing or stopping this VM?

You could add a bit of code that forks QEMU.  The kernel does memory
copy-on-write across fork(2).  Make sure not to use file-backed/shared
memory for guest RAM (but that's okay since it is the default).  The
child process could write out the memory image and then terminate - or
it could sit around waiting for you to inspect it with GDB or some
other mechanism.  If you kill the child process then you lose access
to that memory snapshot.

For production I'm not convinced that this feature is useful.  There
is already support for crash dumping and kernel debugging of guest
OSes.  The mechansim various by guest OS, but it works similar to on a
physical machine.  What "system analytics or forensics" exactly are
useful when you only have access to guest *physical* memory?  Seems
like a development feature that you can hack on locally in a few lines
of code but not something for production.

Stefan