Bug 1250200 – gunziped message log is tailed

Bugzilla will be upgraded to version 5.0. The upgrade date is tentatively scheduled for 2 December 2018, pending final testing and feedback.

Bug 1250200 - gunziped message log is tailed

Summary:	gunziped message log is tailed

Status:	CLOSED ERRATA

Aliases:	None

Product:	Red Hat Enterprise Linux 7
Classification:	Red Hat
Component:	sos (Show other bugs)
Sub Component:
Version:	7.1
Hardware:	All Linux

Priority	unspecified Severity high
Target Milestone:	rc
Target Release:	---
Assigned To:	Pavel Moravec
QA Contact:	Jakub Heger
Docs Contact:

URL:	https://github.com/sosreport/sos/issu...
Whiteboard:
Keywords:

Depends On:
Blocks:	1203710 1295396 1298112 1420851 1464262 1473612
	Show dependency tree / graph

Reported:	2015-08-04 13:53 EDT by Jack Waterworth
Modified:	2018-04-10 14:01 EDT (History)
CC List:	12 users (show)

See Also:
Fixed In Version:	sos-3.5-1.el7
Doc Type:	If docs needed, set a value
Doc Text:
Story Points:	---
Clone Of:
Environment:
Last Closed:	2018-04-10 14:00:19 EDT
Type:	Bug
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

External Trackers
Tracker	ID	Priority	Status	Summary	Last Updated
Github	sosreport/sos/pull/1111	None	None	None	2017-09-24 07:59 EDT
Red Hat Product Errata	RHEA-2018:0963	None	None	None	2018-04-10 14:01 EDT

Groups: None (edit)

Description Jack Waterworth 2015-08-04 13:53:18 EDT

Description of problem:
sosreport from customer contains a gunzip file that has been tailed.

Version-Release number of selected component (if applicable):

sos-3.2-15.el7_1.5.noarch
Red Hat Enterprise Linux Server release 7.1 (Maipo)

How reproducible:
unknown

Steps to Reproduce:
1. run sosreport

Actual results:

--------------------
$ ll var/log/messages*
-rwxrwxrwx 1 jwaterwo jwaterwo      733 Jul 22 10:51 var/log/messages
-rwxrwxrwx 1 jwaterwo jwaterwo 16058057 Apr 19 02:17 var/log/messages-20150419
-rwxrwxrwx 1 jwaterwo jwaterwo 60401880 Apr 27 02:40 var/log/messages-20150427
-rwxrwxrwx 1 jwaterwo jwaterwo 42692864 May  3 02:19 var/log/messages-20150503
lrwxrwxrwx 1 jwaterwo jwaterwo       58 May 10 02:30 var/log/messages-20150510.gz -> ../../sos_strings/logs/var.log.messages-20150510.gz.tailed
--------------------
$ file sos_strings/logs/var.log.messages-20150510.gz.tailed 
sos_strings/logs/var.log.messages-20150510.gz.tailed: empty
--------------------


Expected results:
file should either be gunzipped then tailed, or not tailed at all

Comment 2 Pavel Moravec 2015-08-05 03:28:21 EDT

Reproducer:

1) Create bigger logfile (content doesnt matter):

# ll /var/log/messages-20150701.gz
-rw-r--r--. 1 root root 2825972 Aug  5 09:17 /var/log/messages-20150701.gz
#

2) 
sosreport -o logs -e logs --batch --log-size=1 --build
..
sosreport build tree is located at : /var/tmp/sosreport-pmoravec-sat61-rhel7.gsslab.brq.redhat.com-20150805091835
..

3)
# cd /var/tmp/sosreport-pmoravec-sat61-rhel7.gsslab.brq.redhat.com-20150805091835
# file var/log/messages-20150701.gz
var/log/messages-20150701.gz: symbolic link to `../../sos_strings/logs/var.log.messages-20150701.gz.tailed'
# file sos_strings/logs/var.log.messages-20150701.gz.tailed
sos_strings/logs/var.log.messages-20150701.gz.tailed: empty

4) sos_logs/sos.log having:

2015-08-05 09:18:35,271 INFO: [plugin:logs] collecting string '...^CP^H^NnJ B^@^N^D^UOA)'5.WJ^E"' as 'var.log.messages-20150701.gz.tailed'

Comment 4 Pavel Moravec 2015-11-04 02:11:25 EST

Scope of RHEL7.2 is closed. Re-scheduling to RHEL7.3.

Comment 6 Pavel Moravec 2016-12-28 08:04:14 EST

This is works different in sos 3.3. At least I can reproduce on sos-3.2-35.el7_2.3.noarch but differently on sos-3.3-5.el7_3.noarch :

# rpm -qa | grep sos
sos-3.2-35.el7_2.3.noarch
# sosreport -o logs -e logs --batch --log-size=1 --build
..
# file /var/tmp/$(ls -tr /var/tmp/ | grep sosreport | tail -n1)/sos_strings/logs/var.log.messages-20161212.gz.tailed 
/var/tmp/sosreport-pmoravec-rhel72.gsslab.brq.redhat.com-20161228135738/sos_strings/logs/var.log.messages-20161212.gz.tailed: empty
#
#
# yum upgrade sos -y
..
Updated:
  sos.noarch 0:3.3-5.el7_3                                                                                                                                                                    

Complete!
# sosreport -o logs -e logs --batch --log-size=1 --build
..
# file /var/tmp/$(ls -tr /var/tmp/ | grep sosreport | tail -n1)/sos_strings/logs/var.log.messages-20161212.gz.tailed 
/var/tmp/sosreport-pmoravec-rhel72.gsslab.brq.redhat.com-20161228135851/sos_strings/logs/var.log.messages-20161212.gz.tailed: data
# zcat /var/tmp/sosreport-pmoravec-rhel72.gsslab.brq.redhat.com-20161228135851/sos_strings/logs/var.log.messages-20161212.gz.tailed

gzip: /var/tmp/sosreport-pmoravec-rhel72.gsslab.brq.redhat.com-20161228135851/sos_strings/logs/var.log.messages-20161212.gz.tailed: not in gzip format
#



I.e. originally we were collecting empty file. Now we collect tail of gz file, i.e. damaged archive.

Comment 8 Pavel Moravec 2017-11-02 11:14:50 EDT

Fixed via sos 3.5 rebase.

Comment 15 errata-xmlrpc 2018-04-10 14:00:19 EDT

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHEA-2018:0963

Note You need to log in before you can comment on or make changes to this bug.