Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.
RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.

Bug 1764472

Summary: remove --all-logs from RHOSP preset to prevent high memory usage of sosreport
Product: Red Hat Enterprise Linux 7 Reporter: Takashi Kajinami <tkajinam>
Component: sosAssignee: Jan Jansky <jjansky>
Status: CLOSED ERRATA QA Contact: Miroslav HradĂ­lek <mhradile>
Severity: high Docs Contact:
Priority: unspecified    
Version: 7.6CC: agk, bmr, bshephar, cww, dhill, jhunsaker, jjansky, lyarwood, mhradile, plambri, rlondhe, sbradley
Target Milestone: rc   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: sos-3.9-2.el7 Doc Type: Release Note
Doc Text:
On OpenStack deployments, sosreport does not further collect all logs by default.
Story Points: ---
Clone Of: Environment:
Last Closed: 2020-09-29 20:55:10 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 1784466    

Description Takashi Kajinami 2019-10-23 06:36:15 UTC
Description of problem:

When we take sosreport on nodes where RHOSP is installed, --all-logs option is
automatically added based on the profile for RHOSP nodes.
However, this can cause high memory usage if we have huge size of journal logs stored
in the node, which can happen for long running nodes for example.

IMO we shouldn't enable --all-logs by default, and it should be enabled as optional
so that we can avoid huge memory consumption by sosreport, which can trigger OOMKiller
or node fencing.

Version-Release number of selected component (if applicable):
sos-3.6-11

How reproducible:
Always

Steps to Reproduce:
1. Take sosreport on the node where RHOSP is installed
 $ sudo sosreport -v

Actual results:
--all-logs is enabled by default, and huge memory consumption is observed if the node has large journal log.

Expected results:
--all-logs isn't enabled, and we don't see high memory consumption even if the node has large journal log.

Additional info:
I see that --all-logs is added in my test env with sos-3.7-5 and RHEL7.7

Comment 2 Pavel Moravec 2019-10-23 06:58:36 UTC
Technical background:
(*) --all-logs option is added due to rhosp preset loaded, that contains that option: https://github.com/sosreport/sos/blob/master/sos/policies/redhat.py#L217-L218
(*) this causes journalctl since current boot - without a size limit so huge here - is collected: https://github.com/sosreport/sos/blob/master/sos/plugins/logs.py#L53
(*) sadly, whole that content is kept in memory (known issue we have on todo list to improve)


I would separate two issues here:
- sosreport should not keep whole command output in memory
- should sosreport on RHOSP collect all logs by default? Is there such a requirement?

Is the request to drop --all-logs driven just by the high memory requirements, or by redundancy of those collected logs?

Jake, Lee, could you comment please?

Comment 3 Pavel Moravec 2019-10-23 06:59:42 UTC
Lee, please see previous comment for the needinfo.

Comment 4 Lee Yarwood 2019-10-24 12:20:13 UTC
(In reply to Pavel Moravec from comment #2)
> Technical background:
> (*) --all-logs option is added due to rhosp preset loaded, that contains
> that option:
> https://github.com/sosreport/sos/blob/master/sos/policies/redhat.py#L217-L218
> (*) this causes journalctl since current boot - without a size limit so huge
> here - is collected:
> https://github.com/sosreport/sos/blob/master/sos/plugins/logs.py#L53
> (*) sadly, whole that content is kept in memory (known issue we have on todo
> list to improve)
> 
> 
> I would separate two issues here:
> - sosreport should not keep whole command output in memory
> - should sosreport on RHOSP collect all logs by default? Is there such a
> requirement?
> 
> Is the request to drop --all-logs driven just by the high memory
> requirements, or by redundancy of those collected logs?
> 
> Jake, Lee, could you comment please?

I'm okay dropping this for OSP *if* we clearly advertise this to CEE (and in turn our customers).

Comment 5 Jake Hunsaker 2019-10-24 12:30:30 UTC
Generally speaking I'm not a fan of --all-logs being a default option, so I'm good with removing this from the RHOSP preset. I agree with Lee though, we'll just need to make sure this is properly conveyed to the support teams.

Comment 6 Takashi Kajinami 2019-11-01 02:09:55 UTC
Hi all,

Thanks for working on this topic, and sorry for my late update.

> Is the request to drop --all-logs driven just by the high memory requirements, or by redundancy of those collected logs?

AFAIK sosreport didn't add --all-logs in old versions, and the change to enable it
was introduced recently.
Because I didn't expect that most of people expect to have --all-logs by default.
I think we can start with just disabling it.

On the other hand, we still have risk to cause huge memory consumption
when we explicitly set --all-logs when we try to gather logs.
I'll file another bz to improve memory usage to gather journal in sosreport,
so that we can continue to discuss about this topic.

Please let me know if you have any concerns about filing an independent bz.

Thank you,
Takashi

Comment 7 Pavel Moravec 2019-11-01 08:48:03 UTC
(In reply to Takashi Kajinami from comment #6)
> On the other hand, we still have risk to cause huge memory consumption
> when we explicitly set --all-logs when we try to gather logs.
> I'll file another bz to improve memory usage to gather journal in sosreport,
> so that we can continue to discuss about this topic.
> 
> Please let me know if you have any concerns about filing an independent bz.

There is already a BZ for this:

https://bugzilla.redhat.com/show_bug.cgi?id=1726023

And as I stated we are aware of this problem: 
> (*) sadly, whole that content is kept in memory (known issue we have on todo list to improve)

but it will be tricky to fix this (since e.g. we parse that output for potentially-mutliline secret data to scrub).

Comment 8 Pavel Moravec 2020-02-04 14:36:11 UTC
--all-logs is removed from RHOSP preset in upstream and that will reach RHEL7.9

whole cmd output kept in memory - we are aware of the problem (see sos #1506), no idea how to efficiently fix, probably wont reach RHEL7.

Comment 15 errata-xmlrpc 2020-09-29 20:55:10 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (sos bug fix and enhancement update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHEA-2020:4034