The Wiert Corner – irregular stream of stuff

Jeroen W. Pluimers on .NET, C#, Delphi, databases, and personal interests

  • My badges

  • Twitter Updates

  • My Flickr Stream

  • Pages

  • All categories

  • Enter your email address to subscribe to this blog and receive notifications of new posts by email.

    Join 2,731 other followers

ESXi: some notes on .vswp files; there are actually two types of them!

Posted by jpluimers on 2022/02/23

Earlier this month, I ended ESXi: editing /etc/vmware/hostd/vmInventory.xml to fix the datastore UUID for unavailable VMs part 2 with this:

A final note: I need to check out if .vswp files need to be there at all, as my ESXi servers have plenty of physical memory in order not to swap out to disk. More on that in a future blog post.

Browsing back through my blog posts, I mentioned .vswp files before, but never really dug into them:

Doing more digging, especially about reducing .vswp file size, I first did a bit of browsing on my own systems. There I found that even a simple virtual machine like the archiveteam warrior appliance takes two .vswp files, of which only one is mentioned in the .vmx file. I actually used this virtual machine as example in ESXi: on the console/ssh, when a moved VM pauses during power-on: show which VMs have messages waiting, then answer them mentioning this .vmx file after confirming a copy.

These are the .vswp files:

[root@ESXi-X10SRH-CF:~] find /vmfs/volumes/Samsung980ProNVMe_782DB311B138/base/archiveteam/ | grep -w vswp | xargs -n 1 -I [] ls -Alh "[]"
-rw-------    1 root     root      110.0M May 15 21:29 /vmfs/volumes/Samsung980ProNVMe_782DB311B138/base/archiveteam/archiveteam-warrior-v3-20171013/vmx-archiveteam-warrior-v3-20171013-249107556-1.vswp
-rw-------    1 root     root        3.0G May 15 21:29 /vmfs/volumes/Samsung980ProNVMe_782DB311B138/base/archiveteam/archiveteam-warrior-v3-20171013/archiveteam-warrior-v3-20171013-0ed91464.vswp

The .vmx file mentions this entry with the archiveteam-warrior-v3-20171013-0ed91464.vswp file, not the vmx-archiveteam-warrior-v3-20171013-249107556-1.vswp file:

sched.swap.derivedName = "/vmfs/volumes/6097a4eb-6c6e4c76-46d3-0cc47aaa9742/base/archiveteam/archiveteam-warrior-v3-20171013/archiveteam-warrior-v3-20171013-0ed91464.vswp"

Well, there indeed are two types, and neither of them is encrypted, which can impose a security risk as per [Wayback] security – How to disable swap files in ESXi? – Server Fault (thanks [Wayback] User Marius Burz and [Wayback] User ewwhite):

  • Per VM a .vswp file that has no vmx- prefix, which is used for guest memory swapping.
  • Per VM a .vswp file that does have a vmx- prefix, which is used for swapping out memory for the vmx wrapper process and associated resources used to be able the running of a VM.

That post also explains a few more things:

    1. you can zero size the .vswp file that has no vmx- prefix (effectively disabling the guest memory swapping) by editing the VM settings, then enabling “Reserve all guest memory”:
      Edit settings - archiveteam-warrior-v3-20171013 (ESX/ESXi 4.x virtual machine) - Reserve all guest memory

      Edit settings – archiveteam-warrior-v3-20171013 (ESX/ESXi 4.x virtual machine) – Reserve all guest memory

      It is recommended to only do this in the web GUI, as what happens behind the scenes in the .vmx file (see [Wayback] memory – Immediately Allocate All RAM to Virtual Machine at Power-On – Super User, thanks [Wayback] Ronaldo)  is tricky and consists of two things:

      1. A line with
        sched.mem.pin = "TRUE"

        is added or updated (this corresponds to the value of the above checkbox and is the simple step).

      2. A line with
        sched.mem.min = "####"

        is added or updated which is tricky: this is the maximum “Reservation value” and must exactly correspond to the amount of RAM MB for the VM (which is the same value as the memSize value in the .vmx file, so in this case, the #### is 3072).

      When you change the memSize value in the .vmx file, you have to remember also change the sched.mem.min value. If you change the RAM value in the GUI, this is automatic (see [Wayback/Archive.is] Vmware memory question : vmware).

  1. you can get rid of the .vswp file that does have a vmx- prefix as well by editing the .vmx file:

    In addition, the vmx-*.vswp files can be disabled by setting sched.swap.vmxSwapEnabled to FALSE.

Some links on why configuring 1. via the .vmx file is trickly:

Forcing zero sized .vswp files also solves another potential problem: overcommitting RAM resources. Overcommitting can seriously hamper performance as you can see in [Wayback] Overcommitted resources within ESXi may result in high memory usage or high CPU usage status within ATP UI.

All of the above started with a the [Wayback] esxi vswp – Google Search and these two links:

  • [Wayback] Solved: what is xxx.vswp file what is for? – VMware Technology Network VMTN (explaining it makes overcommitment of memory possible)
  • [Wayback] VM .vswp files – VMware Technology Network VMTN explaining more details, of which this is an abstract:

    The smaller vmx-xxx.vswp that are typically somewhere between ~64-256 MiB in size (depends on number of vCPUs, VM memory size, 32/64 bit Guest OS etc.) are overhead swap files for the VMX-process that is executing the VM on the host. This is unrelated to the actual VM memory swap files.

    The XXXX.vswp files are VM memory swap files. The disk space space consumed by these files is calculated as (configured VM memory sizeVM reserved memory).

    The files are created on power-on and removed when a VM enters the powered-off state.

The secondary vmx-xxx.vswp file is very well explained in [Wayback] vSphere 5.0 New .vswp file & Storage Tax on VDI – myvirtualcloud.net.

Link resurrected from the above Server Fault: entry: [Wayback] Virtual Machine Files Essential to Forensic Investigations | Crucial Security Forensics Blog

–jeroen

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

This site uses Akismet to reduce spam. Learn how your comment data is processed.

 
%d bloggers like this: