# Example: if you want to save sosreport immediately at the moment of a crash:

# (alternatively, you can add similar command to EVENT=analyze_foo's,

# if you would rather perform this collection later):

EVENT=post-create remote!=1

        nice sosreport --tmp-dir "$DUMP_DIR" --batch \

                --only=anaconda --only=boot --only=devicemapper \

                --only=filesys --only=hardware --only=kernel --only=libraries \

                --only=memory --only=networking --only=nfs --only=pam \

                --only=process --only=rpm -k rpm.rpmva=off --only=ssh \

                --only=services --only=yum --only=date --only=host --only=x11 \

                --only=cups --only=logs --only=grub2 --only=cron --only=pci \

                --only=auditd --only=selinux --only=lvm2 --only=sar \

                --only=processor \

                >sosreport.log 2>&1 \

        && {

                rm sosreport.log

                rm sosreport*.md5

                mv sosreport*.tar.bz2 sosreport.tar.bz2

                mv sosreport*.tar.xz sosreport.tar.xz

                exit 0

        } 2>/dev/null

        # Error in sosreport run. Let user see the problem.

        echo "sosreport run failed with exit code $?, log follows:"

        # sosreport prints many useless empty lines, nuke them:

        # it looks awful in syslog otherwise.

        cat sosreport.log | sed 's/  *$//' | grep -v '^$'

        rm sosreport.log

        exit 1