Hide Forgot
I wouldn't bother with strace as a first step. Start by just capturing ps and top data once per second, e.g.: # top -d 1 -b > /tmp/top & # while true; do (date; ps ax --forest)>> /tmp/ps; sleep 1; done And run "sosreport -v --batch -o cluster" or whatever.
I saw similar things testing the original crm_report patch (with artificially inflated log sizes). In some ways it would be helpful if crm_report either had a "--everything" option (but with a better name ;), or an option to say grab the last N-thousand messages. That's generally a lot cheaper than parsing out dates.
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://rhn.redhat.com/errata/RHBA-2015-1323.html