How to Use sosreport — Complete Guide for Linux Sysadmins

Learn how to install, run, and analyze sosreport output on RHEL, CentOS, Ubuntu, and other Linux distributions. This guide covers everything from basic usage to advanced flags.

What is sosreport?
Installing sosreport
Basic Usage
Common Flags & Options
What sosreport Collects
Reading the Output Manually
Automate Analysis with Linux Diagnostic Analyzer

1. What is sosreport?

sosreport (System Overview & Support report) is an open-source diagnostic data collection tool for Linux. It gathers system configuration, logs, and runtime data into a single compressed .tar.xz archive.

Originally developed for Red Hat Enterprise Linux, it's now available on most major distributions:

RHEL / CentOS / Rocky / AlmaLinux — pre-installed or via yum install sos
Ubuntu / Debian — via apt install sosreport
Fedora — pre-installed
SUSE SLES — uses supportconfig instead (similar concept)

2. Installing sosreport


                # RHEL / CentOS / Rocky / AlmaLinux

                $ sudo yum install sos


                # RHEL 8+ / Fedora

                $ sudo dnf install sos


                # Ubuntu / Debian

                $ sudo apt install sosreport


                # Verify installation

                $ sosreport --version

                sosreport 4.7.2

3. Basic Usage


                # Run sosreport (requires root)

                $ sudo sosreport


                # You'll be prompted for:

                # - Case ID (optional, press Enter to skip)

                # - Name (optional, press Enter to skip)


                # Output location:

                /var/tmp/sosreport-hostname-2026xxxx-abcd.tar.xz


                # On RHEL 8/9, the command changed to:

                $ sudo sos report

Tip: sosreport typically takes 1-5 minutes to run depending on system size. The output file is usually 10-50MB.

4. Common Flags & Options

Flag	Description	Example
`--batch`	Non-interactive mode (skip prompts)	`sudo sosreport --batch`
`--tmp-dir`	Custom output directory	`sudo sosreport --tmp-dir /home/user/`
`-o plugin`	Only run specific plugins	`sudo sosreport -o networking,filesys`
`-n plugin`	Skip specific plugins	`sudo sosreport -n docker,podman`
`--all-logs`	Collect full log files (not just recent)	`sudo sosreport --all-logs`
`--clean`	Obfuscate hostnames/IPs in output	`sudo sosreport --clean`
`--list-plugins`	Show available collection plugins	`sosreport --list-plugins`
`--compression-type`	Set compression (xz, gzip, bzip2)	`sudo sosreport --compression-type gzip`

5. What sosreport Collects

When you extract a sosreport archive, you'll find a directory structure like this:


                sosreport-hostname-20260314/

                ├── date                 # System date/time

                ├── dmidecode           # Hardware/BIOS info

                ├── free                 # Memory usage

                ├── hostname            # Server hostname

                ├── ip_addr             # Network interfaces

                ├── lsblk               # Block devices

                ├── ps                   # Running processes

                ├── uname               # Kernel version

                ├── etc/                 # Configuration files

                │   ├── fstab

                │   ├── hosts

                │   ├── sysctl.conf

                │   └── ...

                ├── proc/               # /proc snapshots

                │   ├── cpuinfo

                │   ├── meminfo

                │   └── ...

                ├── var/log/             # System logs

                │   ├── messages

                │   ├── dmesg

                │   └── ...

                └── sos_commands/       # Plugin output

                    ├── networking/

                    ├── filesys/

                    ├── systemd/

                    └── ...

6. Reading the Output Manually

You can extract and browse a sosreport manually:


                # Extract the archive

                $ tar xf sosreport-hostname-*.tar.xz

                $ cd sosreport-hostname-*/


                # Check system info

                $ cat uname

                $ cat hostname

                $ cat date


                # Check memory

                $ cat free

                $ cat proc/meminfo


                # Check disk usage

                $ cat df

                $ cat sos_commands/filesys/mount_-l


                # Check for errors

                $ grep -i error var/log/messages | tail -50

                $ grep -i "oom" var/log/messages

This manual process works but is time-consuming — especially when you need to check 12+ diagnostic areas across multiple servers. That's where automated analysis helps.

7. Automate Analysis with Linux Diagnostic Analyzer

Instead of manually browsing through hundreds of files, upload your sosreport to linuxdiag.org and get an instant health dashboard that covers all 12 diagnostic categories:

Health Score Weighted 0-100 score across all categories

Issue Detection Critical, warning, and info findings prioritized by severity

Recommendations Actionable fix commands for each issue found

Try It Now — Upload Your sosreport

Get a full health dashboard in seconds. Free, no registration required.

Upload & Analyze — It's Free