Observer Analyzer : Observer Analyzer : Getting Started : Virtual machine troubleshooting : Experiencing BSOD when packet capture starts
Experiencing BSOD when packet capture starts
A blue screen of death (BSOD) can occur when Observer is installed on a virtual machine and packet capture begins.
In this case, the issue is specifically related to the Virtual Machine (VM) itself. The VM has been configured in a way that prevents Observer from using memory correctly, and this leads to a system BSOD when packet capture begins.
There are some options in the configuration details of your VM that have been found to resolve this issue. These include disabling hotplug options in your virtual machine settings. The process for disabling memory hot add and CPU hot plug is described in How to disable hot plug VM features .
How to disable hot plug VM features
Hot plug features can interfere with Observer running inside a virtual machine. Disable them to avoid blue screen errors and crashes.
VMware Tools must be installed.
The guest operating system supports Memory/CPU Hotplug.
The virtual machine uses hardware version 7 or later.
Follow the steps outlined in the vSphere Documentation.
Select both Disable memory hot add for this virtual machine and Disable CPU hot plug for this virtual machine in the VM properties.
This means the features will be disabled on this virtual machine.
Figure 2: Disable hot plug options
Memory hot add and CPU hot plug features are now disabled. You should now be able to capture network traffic without experiencing a BSOD.