What is a sosreport and how do I create one in Red Hat Enterprise Linux 4.6 and later?

The sosreport command is a tool that collects configuration and diagnostic information from a Red Hat Enterprise Linux system. For instance: the running kernel version, loaded modules, and system and service configuration files. The command also runs external programs to collect further information and stores this output in the resulting archive.
To run sosreport the sos package must be installed. The package is part of the default group and will be installed automatically on most systems.
If for any reason the package is not present it may be added manually using the following steps:
Red Hat Enterprise Linux 4 Update 6 or later
If the system is registered with Red Hat Network (RHN), sos can be installed using the up2date command:

# up2date sos

Red Hat Enterprise Linux 5 and later
If the system is registered with RHN, use the yum command:

# yum install sos

If the system is not registered with RHN, the sos package can be downloaded from the RHN website or found on the installation CDs or DVD. The rpm command may be used to install the package on any version of Red Hat Enterprise Linux:

 # rpm -Uvh sos-<version>.noarch.rpm

Once the package has been installed issue the following command:
Note: sosreport requires root permissions to run.

# sosreport

The command will normally complete within a few minutes on Red Hat Enterprise Linux 6. Older versions may take longer to complete. Depending on local configuration and the options specified in some cases the command may take longer to finish. If you are concerned about the run time of the sosreport command contact your Red Hat support representative for assistance.
Once completed, sosreport will generate a compressed a file under /tmp. Different versions use different compression schemes (gz, bz2, or xz). The file should be provided to your support representative (normally as an attachment to an open case).
The size of the archive varies depending on system configuration and any optional sosreport features that are enabled (for example specifying the "all_logs" option of the general module to collect all syslog log files may greatly increase the size of the archive).
To avoid the need to enter user and account information interactively the command may be run in batch mode by use of the --batch option. In this case user information is obtained from the system RHN configuration files:

# sosreport --batch

The sosreport command has a modular structure and allows the user to enable and disable modules and specify module options via the command line. To list available modules (plug-ins) use the following command:

# sosreport -l

To turn off a module include it in a comma-separated list of modules passed to the -n/--skip-plugins option. For instance to disable both the kvm and amd modules:

# sosreport -n kvm,amd

Individual modules may provide additional options that may be specified via the -k option. For example on Red Hat Enterprise Linux 4 and 5 installations the sos rpm module collects "rpm -Va" output by default. As this may be time-consuming the behavior may be disabled via:

# sosreport -k rpm.rpmva=off

Note:
1. Red Hat Enterprise Linux 4.5 and earlier include the older sysreport command for creating diagnostic archives. If possible update your system to the sos package included in later releases however sysreports may still be submitted to Red Hat if needed What is the sysreport command and how do I run it ?
2. The sos package in Red Hat Enterprise Linux 4 and 5 also includes a sysreport command. This is a symbolic link provided for backwards compatibility:

# ls -l /usr/sbin/sysreport
lrwxrwxrwx 1 root root 19 Nov  3  2008 /usr/sbin/sysreport -> 

/usr/sbin/sosreport

To use the original (legacy) version of the sysreport script on these installations use the sysreport.legacy command in:

# sysreport.legacy
This utility will go through and collect some detailed information 
about the hardware and setup of your Red Hat Linux system.
This information will be used to diagnose problems with your system
and will be considered confidential information.  Red Hat will use
this information for diagnostic purposes ONLY. 

What to do if a sosreport hangs:

Instead of failure sosreport, please create and run the following script:

#!/bin/bash
host="$(hostname)"

sos_dir="/tmp/${host}_sosreport"
mkdir $sos_dir
cd $sos_dir
chkconfig --list > chkconfig
date > date
df > df
dmesg > dmesg
dmidecode > dmidecode  
fdisk -l > fdisk  
free > free  
hostname --fqdn > hostname  
ifconfig > ifconfig  
lsmod > lsmod  
lspci > lspci  
cat /proc/mounts > mount  
netstat -tlpn > netstat  
ps auxww > ps  
rpm -qa > rpm-qa  
rpm -Va > rpm-Va     #this command may take a while to run  
ulimit -a > ulimit  
uname -a > uname  
uptime > uptime  
cat /proc/meminfo > meminfo  
cat /proc/cpuinfo > cpuinfo  
mkdir etc  
cd etc  
cp /etc/fstab .
cp /etc/cluster.conf .
cp /etc/security/limits.conf .  
cp /etc/redhat-release .  
cp /etc/sysctl.conf .  
cp /etc/modprobe.conf .  
mkdir sysconfig/network-scripts -p  
cd sysconfig  
cp /etc/sysconfig/* . -R  
cd $sos_dir
mkdir var/log -p  
cp /var/log/* var/log -R  
cd /tmp  
tar -cvjf ${host}_sosreport.tar.bz2 $sos_dir