Collecting system information with sos report

The idea

When you ask someone else for help (a colleague, a vendor, Red Hat Support) the first thing they need is the facts about your machine. Typing them into an email loses most of them. sos report runs a long list of read-only collectors and bundles the results into one compressed archive: configuration files, logs, and the output of many commands, with a checksum so the recipient can verify it arrived intact.

You use it in two directions:

• Sending: attach the archive to a support case instead of describing the machine.
• Reading: an archive from another machine (or from yours, an hour before it broke) is a snapshot you can study offline, with grep, without access to the original.

Plugins

The collection is organised into plugins, one per subsystem: networking, systemd, openssh, kernel, selinux, lvm2, block, rpm, logs, and many more. Each plugin knows which files and commands matter for its subsystem. Some plugins are off by default because they are slow or large.

Option	Purpose
--batch	Do not ask questions (no confirmation, no case-id prompt)
--case-id ID	Put a case or ticket number into the archive name
--label WORD	Add a word to the archive name
-o a,b / --only-plugins	Run only the named plugins
-n a,b / --skip-plugins	Skip these plugins
-e a,b / --enable-plugins	Turn on plugins that are off by default
--list-plugins	Show every plugin and whether it is enabled
--tmp-dir DIR	Write the archive here (default /var/tmp)

On older releases the command was sosreport; both names still work on RHEL, and sos report is the current one.

What the archive looks like

sosreport-HOST-CASE-DATE/
  sos_commands/        output of each command, grouped by plugin  (networking/, systemd/, rpm/, ...)
  etc/                 copies of configuration files
  var/log/             log files (messages, secure, audit when collected)
  proc/, sys/          selected kernel interfaces
  sos_reports/         an HTML index (sos.html) and a JSON manifest
  sos_logs/            how the report itself ran, including plugin errors
  version.txt, date, uptime, hostname, installed-rpms ...

Where to look first: sos_reports/sos.html for an index, sos_commands/systemd/systemctl_list-units_--failed-style files for failed units, var/log/messages and var/log/secure for events, sos_commands/networking/ for addresses and routes, and installed-rpms for the package list. Files keep the name of the command that produced them, so ls and grep -r find things quickly.

Safety

An sos archive contains your configuration, host names, IP addresses, user names and sometimes secrets in configuration files. Treat it as sensitive.

• sos tries to remove known password fields in some configuration files, but it cannot recognise every secret.
• sos clean ARCHIVE (also available as sos report --clean) rewrites an archive to replace IP addresses, MAC addresses, host names and domain names with consistent obfuscated values, and writes a mapping file that translates them back. It writes a new archive and leaves the original untouched.
• The mapping file must stay with you: sending it with the archive undoes the obfuscation.

Try it

sudo sos report --batch --case-id EX342-1

sos report (version 4.x)

This command will collect diagnostic and configuration information from
this Red Hat Enterprise Linux system and installed applications.
...
 Setting up archive ...
 Setting up plugins ...
 Running plugins. Please wait ...

  Starting 12/48 networking     [Running: filesys networking  ...]
  Finished running plugins
Creating compressed archive...

Your sos report has been generated and saved in:
	/var/tmp/sosreport-node1-EX342-1-2026-11-04-abcdefg.tar.xz

 Size	21.43MiB
 Owner	root
 sha256	3e5a...c21f

Please send this file to your support representative.

The archive name encodes host, case, date and a random suffix. Verify and look inside:

cd /var/tmp
sha256sum -c sosreport-node1-EX342-1-*.tar.xz.sha256
tar tf sosreport-node1-EX342-1-*.tar.xz | head -6

sosreport-node1-EX342-1-2026-11-04-abcdefg.tar.xz: OK
sosreport-node1-EX342-1-2026-11-04-abcdefg/
sosreport-node1-EX342-1-2026-11-04-abcdefg/sos_commands/
sosreport-node1-EX342-1-2026-11-04-abcdefg/sos_commands/networking/
sosreport-node1-EX342-1-2026-11-04-abcdefg/etc/
sosreport-node1-EX342-1-2026-11-04-abcdefg/var/log/

A focused report

Fewer plugins means a smaller, faster, safer archive. Only collect what the question needs:

sudo sos report --list-plugins | head
sudo sos report --batch --case-id EX342-2 -o networking,systemd,openssh --tmp-dir /root/cases

Reading an archive offline

Extract just what you need rather than the whole archive:

A=/root/cases/sosreport-node1-EX342-2-*.tar.xz
tar xf $A --wildcards '*/etc/resolv.conf' -O
tar xf $A --wildcards '*/sos_commands/systemd/systemctl_list-units*' -O | head

search lab.example
nameserver 192.168.50.1

Because every file is a plain text copy, the usual tools work: grep -ri 'Failed' */var/log/messages, diff between a “before” and “after” archive, and rpm-style queries against installed-rpms.

Obfuscating before you share

sudo sos clean --batch /root/cases/sosreport-node1-EX342-2-*.tar.xz
ls /root/cases

sosreport-node1-EX342-2-2026-11-04-abcdefg.tar.xz
sosreport-obfuscatedhost1-EX342-2-2026-11-04-abcdefg.tar.xz

The second archive is the one to send. The mapping file (named like *-private_map) stays on your machine.

When it does not work

Symptom	Cause	Fix
sos: command not found	Package missing	dnf install sos
Run takes very long or stalls on a plugin	A slow plugin (large rpm verification, big log trees)	Skip it with -n, or limit with -o
No space left on device	/var/tmp full	--tmp-dir on a larger file system
Plugin reports failed to run command	Tool for that plugin not installed, or SELinux denial	Read sos_logs/sos.log in the archive
Archive contains data you must not share	Too many plugins, secrets in configuration	-o fewer plugins, then sos clean, and review before sending
Checksum mismatch at the recipient	Truncated upload	Upload again; compare sha256sum on both ends

Going further

Exam and practice. Expect a task that gives you a reason to produce evidence (for example, “collect networking and system information for a support case and store it under a given directory”) and a checker that looks for the archive, its checksum, and which plugins ran. Learn -o, -n, --tmp-dir, --case-id and --list-plugins. Beyond the exam: sos collect gathers reports from several cluster nodes at once, and insights-client uploads a lighter system profile to Red Hat Insights for automated analysis.