What is an sos report and how to create one in Red Hat Enterprise Linux?

Solution Verified - Updated -

Environment

  • Red Hat Enterprise Linux (RHEL) 4.6+, 5, 6, 7, 8, 9, 10

Issue

Resolution

Table of Contents

What is an sos report and is it different from an sosreport?

A sos report within RHEL 8+ is equivalent to the sosreport command in RHEL7 and earlier. So sos report is the same as sosreport -- just different command syntax used within the sos package.

  • Within RHEL 7 and earlier releases, while the installed package name was sos, the command to capture data from a system was sosreport .
  • Starting with RHEL 8+, the command name was changed to just sos and the optional argument of report is needed to perform the same data collection activities as sosreport in older sos packages.
  • The convention within this document is to utilize the new syntax of sos report generically unless it is specifically referencing a command example where the older syntax of sosreport is used.
  • The command syntax of sosreport will work on all kernel version, but is deprecated in RHEL 8+ kernels and will result in an "Redirecting to sos report" warning output.

The sos report command is a tool that collects configuration details, system information and diagnostic information from a Red Hat Enterprise Linux system. For instance: the running kernel version, loaded modules, and system and service configuration files. The command also runs external programs to collect further information, and stores this output in the resulting archive. The tool itself aims to collect as much diagnostic data as possible, while doing so in a reasonable time and space, and without a substantial impact to the system resources.

» Why am I being asked to provide an sos report?

The output of sos report is the common starting point for Red Hat support engineers when performing an initial analysis of a service request for a Red Hat Enterprise Linux system.

The utility provides a standardized way to collect diagnostic information that your Red Hat support engineer will reference throughout their investigation of issues reported in support cases.

The use of sos report helps to ensure that you are not being continually asked for piecemeal data outputs.

How can I generate an sos report?

Once the sos package has been installed, issue the following commands to run sos report. The first command ensures the latest package is installed so that most current data collection procedures are performed. For RHEL7 and older, please use sosreport instead of sos report command.

# yum update sos
# sos report
Notice Starting in RHEL 8, the sosreport command is deprecated in favor of sos report. A message to this effect is output if sosreport is issued on a RHEL 8+ system and "Redirecting to 'sos report'" is performed. Since yet newer `sos` versions, `sosreport` binary just prints the warning and does not redirect at all.
Notice In RHEL8+, change the above command name to sos report, with the added space between sos and report, to avoid the "Redirecting to sos report" related messages.
Notice The sos report command requires root permissions to gather data correctly. There is no current mechanism to allow non-root executions of sos report.

The command will normally complete within a few minutes on Red Hat Enterprise Linux 6 or newer. Older versions may take longer to complete. Depending on local configuration and the options specified in some cases the command may take longer to finish. If you are concerned about the run time of the sos report command contact your Red Hat support representative for assistance.

Once completed, sos report will generate a compressed file under /tmp (for RHEL6 and earlier) or under /var/tmp (for RHEL7 and later). The file should be provided to your support representative (normally as an attachment to an open support case).

» Running sos report results in "no valid plugins were enabled" message

  • Typically the "no valid plugins" message is output then the sos report command run without full root privileges. The sos report command requires root permissions to gather data from the system correctly. Many of the files, commands, and tools that it runs to gather information required root access privilege. For example, if multipath is configured on the system then sos report will gather information from multipath subsystem on the current configuration settings, which it cannot do as a normal user.

    $ multipathd -k"show config"
need to be root

  • Please try running again as root, and if you are still experiencing issues, open a support case so that we may investigate.*

» Running sos report fills my available disk space

  • The size of the archive varies depending on system configuration and any optional sos report features that are enabled. For example --all-logs will greatly increase the size of the archive as it removes size-limiting features for command output and log file collection.

  • If /tmp/ or /var/tmp is too small to hold an sos report archive, use the --tmp-dir option to specify an alternate location with sufficient available space.

» How do I provide an sos report to Red Hat?

Alternative upload methods that are also available include:

  • To post sos report, or any other file, to an existing support case you can use the redhat-support-tool command line option, the Red Hat Portal UI or several different methods using FTP.
  • If the collected sos report file is too big to upload to the case, it may be uploaded to the Red Hat Secure FTP.
    • If you use the ftp option, update your support case with the exact filename as this is the only way your support engineer will be able to retrieve it.

» I do not have a case number yet, do I need to provide one for sos report to run?

  • The case number input prompt is optional, and if provided the case number will be part of the archive's file name. Omitting the case number will not have any negative effect on running the sos report command.

  • Also, the command may be run in batch mode using the --batch option in order to avoid the need to enter user and account information interactively.

How can I control how the sos report command runs?

The sos report command has a plugin structure and allows the user to enable and disable plugins and specify plugin options via the command line. Available plugins and their options may be listed by running the following command:

# sos report -l

» How can I disable or enable specific plugins?

Users may selectively enable or disable plugins using the -e/--enable-plugins and -n/--skip-plugins options respectively. These options take comma-delimited lists of plugin names or may be specified multiple times. For example, to disable the amd and kvm plugins, use the following:

# sos report -n kvm,amd

» How do I use plugin options?

Individual plugins may provide additional options that may be specified via the -k option. These options are listed in the same output as the listing of available plugins (sos report -l). The format this option takes is plugin_name.option_name=value. For example, to enable collection of container logs, use the following:

# sos report -k podman.logs=on

Options will specify whether they are boolean toggles or expect a string or integer. For boolean toggles, users may use True, on, or yes and False, off, or no interchangeably.

» Why does sos report sometimes skip collecting certain command output?

An sos report execution might print to console a message like the following:

[plugin:networking] skipped command 'nft list ruleset': required kernel modules or services not present (kmods=[nf_tables] services=[]).

sos report aims to not alter the system it runs on in any way. Some commands called by certain plugins may automatically trigger a change (load a kernel module in the example above) and are thus gated by default. If making these changes is acceptable for your environment, and you would like to have sos report make them in order to collect the skipped commands, run sos report like so:

# sos report --allow-system-changes

» *Running sos report on my system uses too much CPU time or memory»* (it is supported with sos version 3.6 or later)

By default sos report will run up to 4 plugins in parallel in an effort to reduce total runtime. This may cause memory contention or high CPU usage on certain systems depending on which plugins are being run (and particularly if each of those plugins collects journal output). To reduce the number of simultaneous collections use the --threads option. For example, to run plugins one at a time, use the following:

# sos report --threads=1

Installing sos package

The sos package must be installed in order to run the sos report command. You can check to see if the sos package is installed and whether there is any problems with the installation using the following command:

# rpm -qa | grep sos
sos-3.2-35.el7_2.3.noarch                  << sos package is installed
# rpm -V sos                               << run verification on installed package

» Red Hat Enterprise Linux 5 and later

If the system is registered with RHSM, use the yum command:

# yum install sos

If the system is not registered with RHSM, the sos package can be downloaded from the RHN website or found on the installation CDs or DVD. The rpm command may be used to install the package on any version of Red Hat Enterprise Linux:

# rpm -Uvh sos-<version>.noarch.rpm

(Note:  the above rpm command may state that there are failed dependencies.  If so, then include the missing RPM files in the same command line.  For example, if it needs the xz RPM, then run:  rpm -Uvh sos-<version>.noarch.rpm xz-<version>.x86_64.rpm .)

Sos Package Update

The sos report command constantly gets updated with important bug fixes and data collection updates to ensure that all the proper data collection needed by our support engineers is performed. Not using the latest sos report often impeded support's ability to review a case in a timely manner and will often require a secondary request for information or an update and redo of sos report. Making sure the latest sos package is installed prevents these issues and inconveniences

# yum update sos

» Red Hat Enterprise Linux 4 Update 6 and later 4.x kernels

If the system is registered with Red Hat Subscription Manager (RHSM), sos can be installed using the up2date command:

# up2date sos

How do I automatically upload an sos report to Red Hat Support?

As of sos-3.9 and later, sos supports the --upload option to automatically upload an archive once it is generated. Note that a local copy of the archive will still exist. This option requires the use of the python3-requests package, which is defined as a weak dependency for the sos rpm. Systems that are not configured to resolve weak dependencies, or do not enable the AppStream repository, will need to manually install this package.

When run on a Red Hat Enterprise Linux system, using the --upload option will prompt the user for their Customer Portal credentials:

# sos report --upload

sos report (version 4.8.2)

[...]

Please enter the case id that you are generating this report for []: 123456
Enter your Red Hat Customer Portal username (empty to use public dropbox): your-username
Please provide the upload password for your-username: 

[...]

Your sosreport has been generated and saved in:
    /var/tmp/sosreport-myhost-123456-2022-08-11-sgczqyo.tar.xz

Attempting upload to Red Hat Customer Portal
Uploaded archive successfully

By providing a case number and login credentials which are capable of accessing the specified case number, sos will upload the resulting archive directly to the case upon completion. If either of these are not provided or are incorrect (e.g. an incorrect case number for the credentials provided), then sos will fallback to uploading the archive to Red Hat's secure FTP server:

# sos report --upload

sos report (version 4.8.2)

[...]

Please enter the case id that you are generating this report for []: 123456
Enter your Red Hat Customer Portal username (empty to use public dropbox): incorrect-user
Please provide the upload password for your-username: 

[...]

Your sosreport has been generated and saved in:
    /var/tmp/sosreport-myhost-123456-2022-08-11-hyrtzji.tar.xz

Attempting upload to Red Hat Customer Portal
Upload to Red Hat Customer Portal failed. Trying sftp://sftp.access.redhat.com
Attempting upload to Red Hat Secure FTP
Unable to retrieve Red Hat auth token using provided credentials. Will try anonymous.
User 'xAnrDdnP'used for anonymous upload. Please inform your support engineer so they may retrieve the data.
Uploaded archive successfully

Note: The anonymous user is a temporary user that may not be re-used, and must be provided to your support engineer in the relevant support case so that the engineer will be able to retrieve and review the archive.

The following methods are available for providing --upload credentials:

  1. Use --upload as demonstrated above, and use the interactive prompts.
    Versions of sos before 4.6.1-1 can use the following options:
  2. Use the --upload-user and --upload-pass to provide the credentials without a prompt. This may be useful when using --batch to avoid interactive executions of sos report. Note however, that this will result in the plaintext password being captured by various process information collections, such as ps.
  3. Use the SOSUPLOADUSER and/or SOSUPLOADPASSWORD environment variables. If set, the --upload function will not prompt for credentials, and these values will not appear in any collections within the archive.

Versions of sos from 4.6.1-1 onwards will make use of the new web authentication system, where the user has to authenticate via an URL and receive a token that will authorize the upload. As a result, options --upload-user and --upload-pass and the equivalent environment variables have been deprecated and will be ignored by sos.

Uploads will fail if network or firewall configuration does not allow access to api.access.redhat.com (for direct-to-case uploads) or sftp.access.redhat.com (for SFTP (fallback) uploads).

How do I run newer sos versions on older RHEL releases?

If your RHEL system is version locked (e.g. EUS), the latest sos package may not available in the older repos. Similarly, recent additions or changes to sos may not always be backported to older RHEL releases for various reasons. However, it is still possible to use the latest sos package on any version of RHEL by use of the support-tools container image.

This container image is consistently maintained and updated with the latest available sos package and is available from the registry.redhat.io container image registry.

In order to collect host-level information with sos via the support-tools container, the image must be deployed in a specific manner. Simply installing the sos package inside a different container will result in collections occurring within the container, which is unlikely to be useful. The requirements for successful host-level collections from inside the container image are baked into the RUN label of the image, and the image may be easily deployed using this label as follows:

# podman container runlabel RUN registry.redhat.io/rhel8/support-tools

    --- You will now be attached to a root shell inside the container ---

# sos report

After sos report completes, it will show the location of the archive being at /host/var/tmp/. The container mounts the host's / filesystem to /host when deployed using the podman command above - so even if the container is exited the tarball will exist on the host under the (normal) /var/tmp location.

Is it safe to run an sos report?

sos report does carefully aim to:

  • obfuscate any passwords, secrets, keys or other credentials in either data collected
  • not alter the system in either way. I.e. no service should be started, no kernel module loaded by an execution of sos or similar.

Red Hat puts a lot of effort to stick to the two goals. Anyway if you would notice otherwise, please raise a support case for Red Hat Support and provide details there.

sos collects sensitive data like hostnames, IP addresses or usernames by default. If that is a concern for you, please use sos clean utility per this solution.

What to do if sos report hangs

First, verify that there is enough free space available in either /tmp (RHEL 6) or /var/tmp (RHEL7 and later), and if not, use the --tmp-dir option as detailed earlier.

If sos report is hanging/stalling on a specific plugin (currently running plugins are displayed during execution), try running sos report with the problem plugin(s) disabled using the -n/--skip-plugins option as detailed earlier.

Note that each plugin has a default timeout of 5 minutes (controllable by the timeout plugin option available to all plugins). Please allow enough time for this timeout threshold to be hit, and sos report should automatically terminate that plugin's execution. In the event that this termination does not happen, use the option highlighted above.

If an sos report can not be completed at all for one reason or another, please see How to gather data from a Red Hat Enterprise Linux system for troubleshooting if the sos report process goes to hung state? for further guidance.

I cannot run sos report at all and would like to collect a bare minimum of data to provide

Please see sos report fails. What data should I provide in its place? for an alternative bare-minimum data collection script.

For issue-specific guidance in the case of sos report failure, please see Additional and alternative steps for gathering an sos report for a Red Hat Enterprise Linux support case

What commands does a particular sos report plugin run in the background?

There are following ways to understand what a particular plugin does when its is executed through the sos report command.

  • Check the source of sos package that provides sos report command.
    For a specific version of source code, see downloads section on Customer Portal.

  • Check sos.log file in the sos report. For example, for plugin scsi there would be something similar to as shown below

    -- directories and files collected --

2020-07-30 11:04:53,632 INFO: [plugin:scsi] collecting path '/sys/bus/scsi'
2020-07-30 11:04:53,656 INFO: [plugin:scsi] collecting path '/sys/class/scsi_disk'
2020-07-30 11:04:53,663 INFO: [plugin:scsi] collecting path '/proc/scsi'
2020-07-30 11:04:53,666 INFO: [plugin:scsi] collecting path '/sys/class/scsi_generic'
2020-07-30 11:04:53,675 INFO: [plugin:scsi] collecting path '/sys/class/scsi_host'
2020-07-30 11:04:53,677 INFO: [plugin:scsi] collecting path '/sys/class/scsi_device'

-- these were the commands executed in the background --

2020-07-30 11:04:53,686 INFO: [plugin:scsi] collecting output of 'lsscsi -i'
2020-07-30 11:04:53,710 INFO: [plugin:scsi] collecting output of 'sg_map -x'
2020-07-30 11:04:53,765 INFO: [plugin:scsi] collecting output of 'udevadm info -a /sys/class/scsi_host/host3'
2020-07-30 11:04:53,789 INFO: [plugin:scsi] collecting output of 'udevadm info -a /sys/class/scsi_host/host1'

  • Generate the sos report only with that particular plugin and check the files and directories and the output of the commands in the collected archive.
    To generate the sos report with particular plugin, do

    # sos report -o plugin-name

  • To see the list of plugins, do

    # sos report -l
  • Component
  • sos

This solution is part of Red Hat’s fast-track publication program, providing a huge library of solutions that Red Hat engineers have created while supporting our customers. To give you the knowledge you need the instant it becomes available, these articles may be presented in a raw and unedited form.

Comments