On Fri, Jul 8, 2011 at 11:24 PM, Ahmed M. Azab <ama...@ncsu.edu> wrote: > Is there a way to take a live memory snapshot of a running VM without > freezing or stopping this VM?
You could add a bit of code that forks QEMU. The kernel does memory copy-on-write across fork(2). Make sure not to use file-backed/shared memory for guest RAM (but that's okay since it is the default). The child process could write out the memory image and then terminate - or it could sit around waiting for you to inspect it with GDB or some other mechanism. If you kill the child process then you lose access to that memory snapshot. For production I'm not convinced that this feature is useful. There is already support for crash dumping and kernel debugging of guest OSes. The mechansim various by guest OS, but it works similar to on a physical machine. What "system analytics or forensics" exactly are useful when you only have access to guest *physical* memory? Seems like a development feature that you can hack on locally in a few lines of code but not something for production. Stefan