sosreport / sos

A unified tool for collecting system logs and other debug information
http://sos.rtfd.org
GNU General Public License v2.0
508 stars 542 forks source link

Should --since option imply --log-size=0 ? #2280

Open pmoravec opened 3 years ago

pmoravec commented 3 years ago

User story (my own): I wanted to collect sosreport capturing all logs since some date. So I requested sos report --since 20201010. To my surprise, logs were truncated by the default --log-size=100.

Should be --since option independent on --log-size (as it is now)? Or should having --since option imply --log-size=0 as we are concerned in all logs since the given time? Or maybe even better, should --since option imply --log-size=0 as default, until --log-size is specified (but where: on cmdline or in config or preset?)?

I feel this depends on subjective user's perception; mine is that --since should imply --log-size=0 - ideally until --log-size is explicitly specified as well.

TurboTurtle commented 3 years ago

I'm really on the fence about this. On one hand, it makes sense that using --since would imply you want all the logs from that time period.

On the other hand, this could very easily snowball into huge sosreports and/or reports that fail to finish collecting due to out of space errors. Especially for environments like RHV or OCP, which have a tendency to produce tremendous amounts of logging in even moderately busy deployments.

pmoravec commented 3 years ago

I am not an orthodox proponent of the potential change, as you wrote it can have those snowball effects.

Maybe worth adding prompt "This can create huge archive, are you sure?", whenever --log-size=0 is implied (i.e. explicitly or via --since)? Only in non-batch mode, of course.

Or just mention the current behaviour in help (or just manpages), and leave it as is?

BryanQuigley commented 3 years ago

I'm slightly leaning to since implying --log-size=0.. I'm against the prompt idea - unless we make it more general for alerting for potential issues.

TurboTurtle commented 3 years ago

Let's call it this way - --since implies --log-size=0 unless log-size is already set to some non-default value.

pmoravec commented 3 years ago

Let's call it this way - --since implies --log-size=0 unless log-size is already set to some non-default value.

This makes sense to me.