A support ticket wants logs, configs and command output, and sos report is the fastest way to bundle all three without missing something. This guide keeps log volume, sensitive data and uploads under control along the way. The examples were checked against sosreport package version 4.10.2-0ubuntu0~24.04.1 on Ubuntu.
sudo access.sos reads configuration, logs, command output and service state, so treat the archive as sensitive even after its normal sanitising step.
Use the current command spelling. This check is read-only and does not need elevated privileges:
$ command -v sos
/usr/bin/sos
$ dpkg-query -W -f='${Package} ${Version}\n' sosreport
sosreport 4.10.2-0ubuntu0~24.04.1
$ sos report --help | sed -n '1,12p'
usage: sos report [options]The older sosreport command is still installed here, but it is deprecated and redirects to sos report. Start new notes and scripts with the latter form. The report component itself requires root privileges, even for listing profiles on this installation.
Checkpoint: You have confirmed the binary and package version, and you will run the collection as sudo sos report ....
A large journal or log set can fill the working filesystem. Ask sos for an estimate first:
$ sudo sos report --estimate-only
# sos prints an approximate space requirement
# no plugin data is retained after the estimateThe estimate is not a reservation. The manpage warns that it can be inaccurate on a busy system, and recommends reserving at least twice the estimate. Keep enough space for temporary collection data as well as the final archive. If the estimate is unexpectedly large, do not simply use --log-size 0: zero removes the normal limit and can make the archive and memory use much larger.
For the first real report, retain the default postprocessing and log limits. Add a label that identifies the incident without putting secrets into the archive name:
$ sudo sos report --label incident-20260927
# answer any prompts, then wait for the completion messagesos collects enabled plugins and can include an HTML summary inside the archive. The default log limit is 25 MiB for ordinary files and command output, while journals have a separate 100 MiB limit. The exact archive name and location are printed by the command, so copy that final line rather than guessing a path.
This command inspects the system but is intended to collect diagnostics, not repair services. It does not give you an undo operation because the collected archive is a new file. Remove that specific archive later if your retention policy permits, after confirming it has been transferred or retained as required.
Checkpoint: The command completed without an error, and you recorded the archive path from its output.
Use a profile or plugin selection when a support request names a subsystem. First inspect the available choices:
$ sudo sos report --list-profiles
# profile names and their plugin sets are printed here
$ sudo sos report --list-plugins
# plugin names and options are printed hereRun one or more profiles with --profile. Multiple profile names can be comma-separated. To select only particular plugins, use --only-plugins; to leave the normal set enabled but suppress a known source, use --skip-plugins. For example, after checking the local plugin list:
$ sudo sos report --profile networking
$ sudo sos report --skip-plugins logsDo not assume that a profile includes an extra plugin enabled with --enable-plugins: the manpage says profile selection does not enable plugins outside the profile. Use --only-plugins when you need to extend that selection deliberately.
Normal postprocessing sanitises data collected by plugins. Never add --no-postproc casually: it disables that processing globally and can leave passwords, SSH keys and certificates in plain text. If a support engineer specifically requires unsanitised data, agree the handling and destination first.
Useful bounded options include:
--log-size 50 raises the ordinary log and command-output limit to 50 MiB, while --journal-size 200 changes the journal limit separately.--since 20260926000000 limits collected log archives to files newer than the supplied timestamp.--skip-files '/etc/example/*' excludes matching paths when a known sensitive location is out of scope.--dry-run runs plugins without collecting file content, command output or string data, which is useful for seeing what would run.Quote wildcard values so the shell does not expand them before sos receives them. Do not use --all-logs or zero-sized limits unless you have checked the available space and genuinely need the additional history.
For a hand-off outside the machine, prefer encryption. --encrypt prompts for a passphrase, key or environment-variable method. A GPG key must already exist in the keyring of the user running sos, so mixing a normal user keyring with sudo can fail. Encryption also needs roughly double temporary space while the archive is being written.
Avoid putting a passphrase or upload password directly in the command line. The manpage warns that an upload password can appear in ps output and then be collected. If you use --upload-url, use an explicit supported protocol and keep SSL verification enabled. --upload-no-ssl-verify weakens certificate checking and should not be used merely to bypass a certificate problem.
Remember that a successful upload does not remove the local archive. Confirm the remote receipt, then handle the local copy according to your incident-retention policy.
sudo sos report, not the deprecated sosreport spelling.