16. How big a sos report is? Written on . Posted in sos command.
The size of a sos report can vary, and understanding why, can help manage expectations and storage requirements. By default, a sos report it's limited to 25 MiB (Megabytes) for logs and command output. The actual size depends on several factors, such as:
- The system's configuration
- Number of installed packages
- Number and size of logs
- Enabled plugins and their output
- Duration of uptime and system activity
- and whether additional features like all-logs are enabled.
For example, using the --all-logs option can significantly increase the size.
The --journal-size places a limit on the size of journals collected in MiB. This option causes sos to capture the last X amount of the journal and this also can significantly increase the size of the final output potentially reaching tens or even hundreds of megabytes or even larger.
The --log-size option, places a limit on the size of collected logs and output in MiB. Note that this causes sos to capture the last X amount of the file or command output collected. By default,this is set to 25 MiB and applies to all files and command output collected with the exception of journal collections, which are limited by the --journal-size option instead.
Please note that setting the --log-size to 0 removes all size limitations, and any files or commands collected will be collected in their entirety, which may drastically increase the size of the final sos report tarball and the memory usage of sos during collection of commands.
Use the --skip-plugins=plugin1,plugin2 to exclude unnecessary data and reduce size.
Typical sosreport size ranges:
| System Type | Approx. Size (Compressed `.tar.xz`) |
| Minimal or container host | 5–20 MB |
| Standard server | 20–100 MB |
| Busy production system | 100–500 MB |
| Heavily loaded or long-uptime system | 500 MB – 1+ GB |
If the report includes things like:
- Core dumps
- Large log directories (e.g., `/var/log/journal`)
- Journald data with `--all-logs`
- Many containers or VMs
then the size can easily exceed 1 GB.
How many sos reports can sos-vault handle?
When you upload a sos report to you vault, it has to be unpacked. This means that the compressed tarball file needs to be expanded inside the vault.
The following table shows a few real examples of the sos report tarball size vs. the unpacked directory size ratio for reference:
| Original tarbal size (MiB) | Unpacked size (MiB) |
| 8.0 | 108 |
| 8.4 | 125 |
| 5.0 | 128 |
| 6.0 | 138 |
| 6.9 | 219 |
| 19.7 | 235 |
| 11.5 | 381 |
| 12.8 | 414 |
The amount of sos reports that sos-vault can handle will depend on the size of your vault and how many packed tar files are stored and how many unpacked directories exists in it.
you can always delete both existing unpacked sos reports and extracted directories when not in use any more from the "Vault Management" page insde sos-vault.
you can upload to you vault as many sos report as the vault size can accomodate, however sos-vault can accept copmpressed tarballs of up to 512 MiB (0.5 GiB).
Summary
While sos report sizes can range from a few megabytes to over a gigabyte, understanding the contributing factors allows you to better prepare and optimize their generation. By tailoring your sosreport options and plugin use, you can generate reports that are both efficient and effective for troubleshooting purposes.
If you're managing a fleet of systems or building tooling around sos reports, factoring in their size and optimizing for your environment can save bandwidth, storage, and time.
In summary, keep in mind that the sos utility defaults to collecting the last 25 MiB of files and command output for logs and journal output. Remember that you can adjust the size limit using options like --skip-plugins, --log-size and --journal-size. Also keep in mind that setting these last two options to 0 removes all size limitations. Using the --all-logs option tells the plugins to collect all possible log data, including non-default locations, which can significantly increase the report size.