Logs Analysis

Logs Analysis Skill

This skill provides detailed guidance for analyzing logs from sosreport archives, including journald logs, system logs, kernel messages, and application logs.

When to Use This Skill

Use this skill when:

• Analyzing the /sosreport:analyze command's log analysis phase
• Investigating specific log-related errors or warnings in a sosreport
• Performing deep-dive analysis of system failures from logs
• Identifying patterns and root causes in system logs

Prerequisites

• Sosreport archive must be extracted to a working directory
• Path to the sosreport root directory must be known
• Basic understanding of Linux log structure and journald

Key Log Locations in Sosreport

Sosreports contain logs in several locations:

1. Journald logs: sos_commands/logs/journalctl_*

   • journalctl_--no-pager_--boot - Current boot logs
   • journalctl_--no-pager - All available logs
   • journalctl_--no-pager_--priority_err - Error priority logs

2. Traditional system logs: var/log/

   • messages - System-level messages
   • dmesg - Kernel ring buffer
   • secure - Authentication and security logs
   • cron - Cron job logs

3. Application logs: var/log/ (varies by application)

   • httpd/ - Apache logs
   • nginx/ - Nginx logs
   • audit/audit.log - SELinux audit logs

Implementation Steps

Step 1: Identify Available Log Sources

1. Check for journald logs:

   ls -la sos_commands/logs/journalctl_* 2>/dev/null || echo "No journald logs found"
   

2. Check for traditional system logs:

   ls -la var/log/{messages,dmesg,secure} 2>/dev/null || echo "No traditional logs found"
   

3. Identify application-specific logs:

   find var/log/ -type f -name "*.log" 2>/dev/null | head -20
   

Step 2: Analyze Journald Logs

1. Parse journalctl output for error patterns:

   # Look for common error indicators
   grep -iE "(error|failed|failure|critical|panic|segfault|oom)" sos_commands/logs/journalctl_--no-pager 2>/dev/null | head -100