[logs] improve log collection for journald-only configurations

If no syslog exists collect the last three days worth of
journald logs by default and allow the user to specify a "log_days"
option to control the data collected.

Fixes #325.

Signed-off-by: Bryn M. Reeves <bmr@redhat.com>

1 files changed, 14 insertions, 1 deletions

diff --git a/sos/plugins/logs.py b/sos/plugins/logs.py
index 4fac5d50..574ca2eb 100644
--- a/sos/plugins/logs.py
+++ b/sos/plugins/logs.py
@@ -52,10 +52,23 @@ class Logs(Plugin):
 
 class RedHatLogs(Logs, RedHatPlugin):
 
+    option_list = [
+        ("log_days", "the number of days logs to collect", "", 3)
+    ]
+
     def setup(self):
         super(RedHatLogs, self).setup()
+        messages = "/var/log/messages"
         self.add_copy_spec_limit("/var/log/secure*", sizelimit=self.limit)
-        self.add_copy_spec_limit("/var/log/messages*", sizelimit=self.limit)
+        self.add_copy_spec_limit(messages + "*", sizelimit=self.limit)
+        # collect five days worth of logs by default if the system is
+        # configured to use the journal and not /var/log/messages
+        if not os.path.exists(messages) and self.is_installed("systemd"):
+            try:
+                days = int(self.get_option("log_days"))
+            except:
+                days = 3
+            self.add_cmd_output('journalctl --all --since="-%ddays"' % days)
 
 
 class DebianLogs(Logs, DebianPlugin, UbuntuPlugin):