# Example: if you want to save sosreport immediately at the moment of a crash:
# (alternatively, you can add similar command to EVENT=analyze_foo's,
# if you would rather perform this collection later):
EVENT=post-create remote!=1
        nice sosreport --tmp-dir "$DUMP_DIR" --batch \
                --only=anaconda --only=boot --only=devicemapper \
                --only=filesys --only=hardware --only=kernel --only=libraries \
                --only=memory --only=networking --only=nfs --only=pam \
                --only=process --only=rpm -k rpm.rpmva=off --only=ssh \
                --only=services --only=yum --only=date --only=host --only=x11 \
                --only=cups --only=logs --only=grub2 --only=cron --only=pci \
                --only=auditd --only=selinux --only=lvm2 --only=sar \
                --only=processor \
                >sosreport.log 2>&1 \
        && {
                rm sosreport.log
                rm sosreport*.md5
                mv sosreport*.tar.bz2 sosreport.tar.bz2
                mv sosreport*.tar.xz sosreport.tar.xz
                exit 0
        } 2>/dev/null
        # Error in sosreport run. Let user see the problem.
        echo "sosreport run failed with exit code $?, log follows:"
        # sosreport prints many useless empty lines, nuke them:
        # it looks awful in syslog otherwise.
        cat sosreport.log | sed 's/  *$//' | grep -v '^$'
        rm sosreport.log
        exit 1