How do I capture the full state of a virtual guest

From the host: capture RAM

Method one to capture RAM

  • Install gdb: apt install gdb
  • Determine pid of guest and find partition with more available disk space that the RAM of the guest
  • gcore /path/to/fs/<guest>.gcore <pid>

Method two to capture RAM

  • Become the guest user
  • Open qemu console: socat vms/<guest-name>/monitor.socket STDIO
  • Stop the guest: stop
  • Dump member: dump-guest-memory /path/to/dir/mem.raw
  • Optionally, start: cont

From laptop - capture running details

  • ssh root@$host 'ss -plantu' > ss.out
  • ssh root@$host 'pstree -a' > pstree.out
  • ssh root@$host 'lsmod' > lsmod.out
  • ssh root@$host 'lsof -P -n' > lsof.out
  • ssh root@$host 'who -aw' > who.out

Kill the guest

Don’t run shutdown, etc because it might be compromised. Instead use: systemctl kill --signal=SIGKILL kvm@guest to ensure it is immediately killed and won’t restart.