Did you know that the Linux sos command is available in most Linux distributions and that in 53 seconds it generates a compressed and encrypted tar file of less than 15MB containing over 10,000 text files, including logs, output from more than 500 diagnostic commands, and over 1,800 configuration files? This file can then be transferred to a secure server so that the information can be analyzed by your team (or by an AI) making it easy to be integrated into your existing CI/CD pipeline.

In less than a minute, you have all the information needed to detect problems, find root causes (RCA), take inventory, review system security, or measure system performance without needing to establish a single server session. This translates to greater security and less exposure, and the ability to analyze the same information simultaneously by different teams (SRE, NetTeam, DBA, DevOps, SecOps, QA, etc.).

This compressed and encrypted tar file is known as a sosreport. And if you maintain a history of sosreports for each server, you can compare them or the same server over time to identify discrepancies in behavior, configuration changes, and keep an inventory of hardware and software.

sos is not a monitoring system or a SIEM. It's a diagnostic tool. And it's completely open-source.

I write articles about the sos command because there is much more to say about it. Visit my blog https://sos-vault.com/blog/sos-command

sos-vault is the solution that helps you archive, manage, and keep your sosreports organized and secure, as well as providing tools that allow you to more easily compare and analyze the information contained in the reports. Soon, you'll also be able to use your favorite LLM to automatically and efficiently analyze a sosreport using an agent.

Visit https://sos-vault.com to see how it works or if you want to know more about the sos command.