SOS_COLLECT(1)

📦
version 4.11.2 · 4 versions
, in ubuntu jammy, ubuntu noble

💅 SOS_COLLECT(1) — sos_collect 💅

🎀 NAME 🎀

<pink>sos_collect</pink> — collect sos reports from multiple (cluster) nodes ✨

✨ SYNOPSIS ✨

okay bestie, the way you summon this thing is literally:

sos collect
    [-a|--all-options]
    [-b|--become]
    [--batch]
    [-c CLUSTER_OPTIONS]
    [--chroot CHROOT]
    [--case-id CASE_ID]
    [--cluster-type CLUSTER_TYPE]
    [--container-runtime RUNTIME]
    [-e ENABLE_PLUGINS]
    [--encrypt-key KEY]
    [--encrypt-pass PASS]
    [--group GROUP]
    [-j|--jobs JOBS]
    [--save-group GROUP]
    [--nopasswd-sudo]
    [-k PLUGIN_OPTION]
    [--label LABEL]
    [--log-size SIZE]
    [-n SKIP_PLUGINS]
    [--nodes NODES]
    [--no-pkg-check]
    [--no-local]
    [--primary PRIMARY]
    [--image IMAGE]
    [--force-pull-image TOGGLE, --pull TOGGLE]
    [--registry-user USER]
    [--registry-password PASSWORD]
    [--registry-authfile FILE]
    [-o ONLY_PLUGINS]
    [-p SSH_PORT]
    [--password]
    [--password-per-node]
    [--preset PRESET]
    [--skip-commands COMMANDS]
    [--skip-files FILES]
    [-s|--sysroot SYSROOT]
    [--ssh-user SSH_USER]
    [--sudo-binary BINARY]
    [-t|--threads THREADS]
    [--timeout TIMEOUT]
    [--transport TRANSPORT]
    [--tmp-dir TMP_DIR]
    [-v|--verbose]
    [--verify]
    [-z|--compression-type COMPRESSION_TYPE]

💖 DESCRIPTION 💖

so <cyan>collect</cyan> is an sos subcommand, and its whole thing is collecting sos reports from a bunch of nodes and packing them into one single useful tar archive. iconic behavior, honestly. 🫶

you can run <pink>sos collect</pink> either from a workstation that already has SSH key authentication set up for the nodes in a given cluster, or from a "primary" node inside a cluster that has SSH keys configured for the other nodes. either way, she's connecting and collecting. 💅

some sos report options are supported by sos-collect and get passed directly to the sos report command that runs on each node. so yes, bestie, your fave report flags can come along for the ride. ✨

Note: the sos-collector command has been deprecated and will be removed in sos-4.9. use the new sos collect syntax instead. no cap, this is your sign to migrate. 💀

👑 OPTIONS 👑

  • -a, --alloptions — enables all sos report options.

this does NOT enable all sos collect options. read that again, bestie. it's giving "report options only" energy. 💅

  • -b, --become — become the root user on the remote node when connecting as a non-root user. glow-up via sudo, basically. 👑
  • --batch — run in non-interactive mode. this will skip prompts for user input. no small talk, just collection. 🎀
  • --all-logs — Report option. collects all logs regardless of size.

Default: no

  • -c CLUSTER_OPTIONS — specify options used by cluster profiles. the format is 'profile.option_name=value'.

for example, for the ovirt plugin, if you wanted to restrict node enumeration to a specific cluster, you would use '-c ovirt.cluster=example_cluster'. 🦋

available cluster options can be listed by running 'sos collect -l'.

  • --chroot CHROOT — Report option. set the chroot mode. when --sysroot is used, commands default to executing with SYSROOT as the root directory. this can be overridden by setting --chroot to "always" (always chroot) or "never" (always run in the host namespace). pick your vibe, but pick wisely. ✨
  • --case-id CASE_ID — Report option. specifies a case number identifier. so the archive knows which case it belongs to. 💖
  • --cluster-type CLUSTER_TYPE — when run by itself, sos collect will attempt to identify the type of cluster at play. this is done by checking package or configuration information against the localhost, or the primary node if "--primary" is supplied.

setting --cluster-type skips this step and forcibly sets a particular profile.

using a value of none or jbon (just a bunch of nodes) will effectively disable all cluster-specific checks, and cause sos collect to only use the nodes specified by the --nodes option. note that in this scenario, regex string(s) for node names will be ignored. 🙈

Example: sos collect --cluster-type=kubernetes will force the kubernetes profile to be run, and thus set sos report options and attempt to determine a list of nodes using that profile.

  • --container-runtime RUNTIME — sos report option. using this with collect will pass this option thru to nodes with sos version 4.3 or later. this option controls the default container runtime plugins will use for collections. see man sos-report. 🐳
  • -e ENABLE_PLUGINS, --enable-plugins ENABLE_PLUGINS — Report option. use this to enable a plugin that would otherwise not be run.

this option supports providing a comma-delimited list of plugins. slay, multi-select. 💅

  • --encrypt-key KEY — encrypts the resulting archive that sos collect produces using GPG. KEY must be an existing key in the user's keyring as GPG does not allow for keyfiles. KEY can be any value accepted by gpg's 'recipient' option.

note that the user running sos collect must match the user owning the keyring from which keys will be obtained. in particular, this means that if sudo is used to run sos collect, the keyring must also be set up using sudo (or direct shell access to the account).

users should be aware that encrypting the final archive will result in sos using double the amount of temporary disk space — the encrypted archive must be written as a separate, rather than replacement, file within the temp directory that sos writes the archive to. however, since the encrypted archive will be the same size as the original archive, there is no additional space consumption once the temporary directory is removed at the end of execution. ✨

this means that only the encrypted archive is present on disk after sos finishes running.

if encryption fails for any reason, the original unencrypted archive is preserved instead. she's got a backup plan. 💖

IMPORTANT: as of this version of sos collect, only the final archive on the local machine running sos collect will be encrypted. the individual sos reports that are collected on the nodes will be collected unencrypted. so the local archive gets the lock, but the node reports are still out here raw. 😭
  • --encrypt-pass PASS — the same as --encrypt-key, but use the provided PASS for symmetric encryption rather than key-pair encryption. same energy, different crypto route. 🔐
  • --group GROUP — specify an existing host group definition to use.

host groups are pre-defined settings for the cluster-type, primary node, and nodes options saved in JSON-formatted files under /etc/sos/groups.d/<GROUP>.

if cluster_type and/or primary are set in the group, sos collect behaves as if these values were specified on the command-line.

if nodes is defined, sos collect extends the --nodes option, if set, with the nodes or regexes listed in the group.

note that sos collect will only write group definitions to /etc/sos/groups.d/ however the GROUP value may be a filename for any group definitions that exist outside of the default location. if you are manually writing these files, use the value null when a python NoneType is expected. Caveat: use string 'none' if setting cluster_type to none. this is the kind of detail that separates the besties from the impostors. 💅

  • --save-group GROUP — save the results of this run of sos collect to a host group definition.

sos-collector will write a JSON-formatted file with name GROUP to /etc/sos/groups.d/ with the settings for cluster-type, primary, and the node list as discovered by cluster enumeration. note that this means regexes are not directly saved to host groups, but the results of matching against those regexes are. so the receipts are saved, not the search bar. 🎀

  • -j JOBS --jobs JOBS — specify the number of concurrent node collections that should be run.

if the number of nodes enumerated exceeds the number of JOBS, then sos collect will start collecting from the first X number of nodes and then continue to iterate through the remaining nodes as sos report collection finishes.

Defaults to 4. four parallel besties, minimum. 👑

  • --nopasswd-sudo — use this option when connecting as a non-root user that has passwordless sudo configured.

if this option is omitted and a bogus sudo password is supplied, collection of sos reports may exhibit unexpected behavior and/or fail entirely. so don't be messy, bestie. 💀

  • -k PLUGIN_OPTION, --plugin-option PLUGIN_OPTION — Report option. set a plugin option to a particular value. this takes the form of plugin_name.option_name=value.

Example: to enable the kubernetes "all" option in sos report use -k kubernetes.all=on.

  • --label LABEL — specify a label to be added to the archive names. this label will be applied to both the sos collect archive and the sos report archives.

if a cluster sets a default label, the user-provided label will be appended to that cluster default. cute little name tag moment. 🏷️

  • --log-size SIZE — places a limit on the size of collected logs and output in MiB. note that this causes sos to capture the last X amount of the file or command output collected.

by default, this is set to 25 MiB and applies to all files and command output collected with the exception of journal collections, which are limited to 100 MiB.

setting this value to 0 removes all size limitations, and any files or commands collected will be collected in their entirety, which may drastically increase the size of the final sos report tarball and the memory usage of sos during collection of commands, such as very large journals that may be several GiB in size. so 0 is giving unlimited, and unlimited is giving "hope your disk is hydrated." 😭

  • -n SKIP_PLUGINS, --skip-plugins SKIP_PLUGINS — Report option. disable (skip) a particular plugin that would otherwise run. this is useful if a particular plugin is prone to hanging for one reason or another. not me ghosting a plugin that's acting up. 💅

this option supports providing a comma-delimited list of plugins.

  • --nodes NODES — provide a comma-delimited list of nodes to collect sos reports from, or a regex string to be used to compare discovered node names against. if using a regex, only nodes matching the regex will be used — i.e. it can be used as a whitelist but not a blacklist. so it's giving "invite list only," not "block list." ✨

this option can be handed multiple regex strings separated by commas. additionally, both whole node names/addresses and regex strings may be provided at the same time.

  • --no-pkg-check — do not perform package checks. most cluster profiles check against installed packages to determine if the cluster profile should be applied or not. so this flag is you saying "bestie, I already know, skip the vibe check." 🫶

Use this with --cluster-type if there are rpm or apt issues on the primary/local node.

  • --no-local — bestie, do NOT collect a sos report from the local system. That's it, that's the whole vibe.

If --primary is not supplied, it's assumed that the host running sos report is part of the cluster that's getting collected. Use this option to skip collection of a local sos report.

This option is NOT needed if --primary is provided. Like, genuinely, don't.

  • --primary PRIMARY — tell it a primary node IP address or hostname for the cluster. Drop it in and sos collect will check the primary node instead of localhost to figure out what type of cluster is in use. ✨
  • --image IMAGE — specify an image to use for the temporary container created for collections on a containerized host, if you don't want the default image specified by the host's policy. Note that this should include the registry.
  • --force-pull-image TOGGLE, --pull TOGGLE — when collecting an sos report from a containerized host, force the host to always pull the specified image, even if that image already exists on the host. This is useful to ensure that the latest version of that image is always in use. Disabling this option will use whatever version of the image is present on the node, and only attempt a pull if there is no copy of the image present at all.

Enable with true/on/yes or disable with false/off/no.

Default: true

  • --registry-user USER — specify the username to authenticate to the registry with in order to pull the container image. 🔐
  • --registry-password PASSWORD — specify the password to authenticate to the registry with in order to pull the container image. If no password is required, leave this blank.
  • --registry-authfile FILE — specify the filename to use for providing authentication credentials to the registry to pull the container image.
Note that this file must exist on the node(s) performing the pull operations, not the node from which sos collect was run. So like, the file's got to be there on the other side, okay?
  • -o ONLY_PLUGINS, --only-plugins ONLY_PLUGINS — Report option. Run ONLY the plugins listed.
Note that a cluster profile will NOT override this option. This may cause the sos reports generated to not contain the relevant output for a given type of cluster. 😬

This option supports providing a comma-delimited list of plugins.

  • --password — specifying this option will cause sos collect to prompt the user for an SSH password that will be used to connect to all nodes.

If you have differing passwords for the same user across cluster nodes, you should ideally deploy SSH keys, but the --password-per-node option is also available. 💅

  • --password-per-node — with this one, sos collect will prompt the user for the SSH password for each node that will have an sos report collected from it, individually, before attempting to connect to the nodes.
  • --preset PRESET — specify a sos preset to use. Note that this requires sos-3.6 or later to be installed on the node. The given preset must also exist on the remote node — local presets are not used.

If --preset is specified and a given node either does not have that preset defined, or has a version of sos prior to 3.6, this option is ignored for that node. 🙈

  • -p SSH_PORT, --ssh-port SSH_PORT — specify SSH port for all nodes. Use this if SSH runs on any port other than 22.
  • --skip-commands COMMANDS — a comma delimited list of commands to skip execution of, but still allowing the rest of the plugin that calls the command to run. This will generally need to be some form of UNIX shell-style wildcard matching. For example, using a value of hostname will skip only that single command, while using hostname* will skip all commands with names that begin with the string "hostname".
  • --skip-files FILES — a comma delimited list of files or filepath wildcard matches to skip collection of. Values may either be exact filepaths or paths using UNIX shell-style wildcards, for example /etc/sos/*.
  • --ssh-user SSH_USER — specify an SSH user for sos collect to connect to nodes with. Default is root.

sos collect will prompt for a sudo password for non-root users.

  • --sudo-binary BINARY — specify the binary to use for privilege escalation on remote hosts when connecting as a non-root user. Note that this binary MUST be in the connecting user's PATH on the remote host. Like, non-negotiable, bestie.
  • -s SYSROOT, --sysroot SYSROOT — Report option. Specify an alternate root file system path.
  • -t THREADS, --threads THREADS — Report option. Specify the number of collection threads to run.

The report process on each node will run THREADS number of plugins concurrently during the collection process.

Defaults to 4.

  • --timeout TIMEOUT — timeout for sos report generation on each node, in seconds.
Note that sos reports are collected in parallel, so you can approximate the total runtime of sos collect via timeout*(number of nodes/jobs).

Default is 180 seconds.

  • --transport TRANSPORT — specify the type of remote transport to use to manage connections to remote nodes.

sos collect uses locally installed binaries to connect to and interact with remote nodes, instead of directly establishing those connections. By default, OpenSSH's ControlPersist feature is preferred, however certain cluster types may have preferences of their own for how remote sessions should be established.

The types of transports supported are currently as follows:

  • auto — allow the cluster type to determine the transport used
  • control_persist — use OpenSSH's ControlPersist feature. This is the default behavior
  • oc — use a locally configured oc binary to deploy collection pods on OCP nodes
  • --tmp-dir TMP_DIR — specify a temporary directory to save sos archives to. By default one will be created in /tmp and then removed after sos collect has finished running.
This is NOT the same as specifying a temporary directory for sos report on the remote nodes. Two totally different things, don't get it twisted. 🫶
  • -v, --verbose — print debug information to screen. 👀
  • --verify — Report option. Passes the "--verify" option to sos report on the nodes, which causes sos report to validate plugin-specific data during collection.
Note that this option may considerably extend the time it takes sos report to run on the nodes. Consider increasing --timeout when using this option. ⏳
  • -z COMPRESSION, --compression-type COMPRESSION — Report option. Override the default compression type.

🌈 SEE ALSO 🌈

sos(1) sos-report(1) sos-clean(1) sos.conf(5)

👑 MAINTAINER 👑

Maintained on GitHub at https://github.com/sosreport/sos

💖 AUTHORS & CONTRIBUTORS 💖

See AUTHORS file in the package documentation.

and that's the whole page, bestie!! this one's the April 2020 era of SOS_COLLECT(1) — go forth and collect those reports, you absolute icon 💅✨🎀

📦 where this page comes from