# Example: if you want to save sosreport immediately at the moment of a crash:
# (alternatively, you can add similar command to EVENT=analyze_foo's,
# if you would rather perform this collection later):
EVENT=post-create remote!=1
nice sosreport --tmp-dir "$DUMP_DIR" --batch \
--only=anaconda --only=boot --only=devicemapper \
--only=filesys --only=hardware --only=kernel --only=libraries \
--only=memory --only=networking --only=nfs --only=pam \
--only=process --only=rpm -k rpm.rpmva=off --only=ssh \
--only=services --only=yum --only=date --only=host --only=x11 \
--only=cups --only=logs --only=grub2 --only=cron --only=pci \
--only=auditd --only=selinux --only=lvm2 --only=sar \
--only=processor \
>sosreport.log 2>&1 \
&& {
rm sosreport.log
rm sosreport*.md5
mv sosreport*.tar.bz2 sosreport.tar.bz2
mv sosreport*.tar.xz sosreport.tar.xz
exit 0
} 2>/dev/null
# Error in sosreport run. Let user see the problem.
echo "sosreport run failed with exit code $?, log follows:"
# sosreport prints many useless empty lines, nuke them:
# it looks awful in syslog otherwise.
cat sosreport.log | sed 's/ *$//' | grep -v '^$'
rm sosreport.log
exit 1