What is a snapshot?

A snapshot preserves the state and data of a virtual machine at a specific point in time.

  • The state includes the virtual machine’s power state (for example, powered-on, powered-off, suspended).
  • The data includes all of the files that make up the virtual machine. This includes disks, memory, and other devices, such as virtual network interface cards.

A virtual machine provides several operations for creating and managing snapshots and snapshot chains. These operations let you create snapshots, revert to any snapshot in the chain, and remove snapshots. You can create extensive snapshot trees.

How do snapshots work?

Our VMware API allows VMware and third-party products to perform operations with virtual machines and their snapshots. This is a list of common operations that can be performed on virtual machines and snapshots using our API:

  • CreateSnapshot: Creates a new snapshot of a virtual machine. As a side effect, this updates the current snapshot.
  • RemoveSnapshot: Removes a snapshot and deletes any associated storage.
  • RemoveAllSnapshots: Remove all snapshots associated with a virtual machine. If a virtual machine does not have any snapshots, then this operation simply returns successfully.
  • RevertToSnapshot: Changes the execution state of a virtual machine to the state of this snapshot. This is equivalent to the Go To option under the Snapshot Manager while using vSphere/VI client GUI.
  • Consolidate: Merges the hierarchy of redo logs. This is available in vSphere 5.0 and later.

This is a high-level overview of how to create, remove, or revert snapshot requests that are processed within the VMware environment:

  1. A request to create, remove, or revert a snapshot for a virtual machine is sent from the client to the server using the VMware API.
  2. The request is forwarded to the VMware ESX host that is currently hosting the virtual machine that has issue.

    Note: This only occurs if the original request was sent to a different server, such as vCenter, which is managing the ESX host.

  3. If the snapshot includes the memory option, the ESX host writes the memory of the virtual machine to disk.
  4. If the snapshot includes the quiesce option, the ESX host requests the guest operating system to quiesce the disks via VMware Tools.
  5. The ESX host makes the appropriate changes to the virtual machine’s snapshot database (.vmsd file) and the changes are reflected in the Snapshot Manager of the virtual machine.
  6. The ESX host calls a function similar to the Virtual Disk API functions to make changes to the child disks (-delta.vmdk and .vmdk files) and the disk chain.

When a snapshot is created, it is comprised of these files:

  • -.vmdk and –delta.vmdk

    A collection of .vmdk and -delta.vmdk files for each virtual disk is connected to the virtual machine at the time of the snapshot. These files can be referred to as child disks, redo logs, or delta links. These child disks can later be considered parent disks for future child disks. From the original parent disk, each child constitutes a redo log pointing back from the present state of the virtual disk, one step at a time, to the original.


    • The value may not be consistent across all child disks from the same snapshot. The file names are chosen based on filename availability.
    • If the virtual disk is larger than 2TB in size, the redo log file is of –sesparse.vmdk format.
  • .vmsd

    The .vmsd file is a database of the virtual machine’s snapshot information and the primary source of information for the Snapshot Manager. The file contains line entries which define the relationships between snapshots as well as the child disks for each snapshot.

  • Snapshot.vmsn

    The .vmsn file includes the current configuration and optionally the active state of the virtual machine. Capturing the memory state of the virtual machine lets you revert to a turned on virtual machine state. With nonmemory snapshots, you can only revert to a turned off virtual machine state. Memory snapshots take longer to create than nonmemory snapshots.

The disk chain

Generally, when you create a snapshot for the first time, the first child disk is created from the parent disk. Successive snapshots generate new child disks from the last child disk on the chain. The relationship can change if you have multiple branches in the snapshot chain.

This diagram is an example of a snapshot chain. Each square represents a block of data or a grain as described in the preceding section:

Follow these best practices when using snapshots in the vSphere environment:

  • Do not use snapshots as backups.

    The snapshot file is only a change log of the original virtual disk, it creates a place holder disk, virtual_machine-00000x-delta.vmdk, to store data changes since the time the snapshot was created. If the base disks are deleted, the snapshot files are not sufficient to restore a virtual machine.

  • Maximum of 32 snapshots are supported in a chain. However, for a better performance use only 2 to 3 snapshots.
  • Do not use a single snapshot for more than 72 hours.

    The snapshot file continues to grow in size when it is retained for a longer period. This can cause the snapshot storage location to run out of space and impact the system performance.

  • When using a third-party backup software, ensure that snapshots are deleted after a successful backup.

    Note: Snapshots taken by third party software (through API) may not appear in the Snapshot Manager. Routinely check for snapshots through the command-line.

  • Ensure that there are no snapshots before:
    • Performing Storage vMotion in vSphere 4.x and earlier environments.

      Note: vSphere 5.0 and later support Storage vMotion with snapshots on a virtual machine.

    • Increasing the virtual machine disk size or virtual RDM.

      Increasing the disk size when snapshots are still available can corrupt snapshots and result in data loss.