Sosreport does not include all sar data in Red Hat Enterprise Linux

Environment

• Red Hat Enterprise Linux 9
• Red Hat Enterprise Linux 8
• Red Hat Enterprise Linux 7
• Red Hat Enterprise Linux 6
• component
  • sos-2.2-68.el6 or later

Issue

• Not all sar data files are collected by sosreport.

Resolution

• The following option enables sosreport to collect all sar data when you run the sosreport.

    sosreport -k sar.all_sar=on
  

  Starting with sos-4.7.2, the option is now sar.all-sar:

    sosreport -k sar.all-sar=on
  

• To make the plugin option permanent, the sar.all_sar option can be enabled as default setting in the sos's configuration file.

  • For RHEL6, RHEL7, and RHEL8.3 or earlier, update the section [tunables] of the file /etc/sos.conf with the following setting:

    [tunables]
    sar.all_sar=on

  • For RHEL8.4 or later and RHEL9, update the section [plugin_options] of the file /etc/sos/sos.conf with the following setting:

    [plugin_options]
    sar.all_sar=on

    Starting with sos-4.7.2, the option is now sar.all-sar:

    [plugin_options]
    sar.all-sar=on

Root Cause

• Sos package was updated to sos-2.2-68.el6, and default sar data collecting way was changed.
• The advisory(RHBA-2014:1528-1) explain in detail as the following.

Depending on site-local configuration, large quantities of System Activity
Reporter (SAR) data could be present on systems. Previous versions of the sos
utility attempted to collect all data present, potentially leading to very large
report sizes and slow data collection. This update applies a size limit to both
binary and text data captured by the SAR module, and SAR data in the report are
now limited to 20 MB by default. In addition, a new "all_sar" option has been
added to the module to request the old behavior. (BZ#1001600)

This solution is part of Red Hat’s fast-track publication program, providing a huge library of solutions that Red Hat engineers have created while supporting our customers. To give you the knowledge you need the instant it becomes available, these articles may be presented in a raw and unedited form.