How do I collect logs from failed Amazon EC2 Linux instances?

Resolution

To troubleshoot and identify the root cause of failed Amazon EC2 Linux instances, you must collect logs. To access and retrieve logs from Amazon EC2 Linux instances, choose the option that best fits your use case:

• Use EC2Rescue for Linux to access the instance and collect logs.
• Use the chroot function to access the instance and the sosreport tool to collect logs.

Use EC2Rescue to access the instance and collect logs

For Linux instances, use the EC2Rescue for Linux feature to access the instance and collect logs. EC2Rescue is a preinstalled agent that allows you to troubleshoot and repair instances from the AWS Management Console or AWS Command Line Interface (CLI).

Note: If you receive errors when you run AWS CLI commands, then see Troubleshoot AWS CLI errors. Also, make sure that you're using the most recent AWS CLI version.

Use chroot to access the instance and sosreport to collect logs

If EC2Rescue for Linux isn't an option, then use the chroot function to access the instance. Then, use the sosreport tool from the GitHub website to collect logs.

Use chroot to access the instance

Amazon Linux 2

If you use Amazon Linux 2, then follow these steps:

1. Open the Amazon EC2 console. Note: Be sure that you're in the correct AWS Region.
2. To access the instance, use the chroot function. Use Amazon Linux 2023 as the rescue instance. For more information, see use a rescue instance.

Amazon Linux 2023

If you use Amazon Linux 2023, then follow these steps:

1. Open the Amazon EC2 console. Note: Be sure that you're in the correct AWS Region.
2. To access the instance, use the chroot function. Use Amazon Linux 2023 as the rescue instance. For more information, see use a rescue instance.

Note: Run the following command to install an additional pip package for Amazon Linux 2023:

dnf install pip -y

Create the sos report

To install and generate the sos report, complete the following steps:

1. Use python3 to install the sosreport util from the official GitHub repository on the GitHub website:

   python3 -m pip install https://github.com/sosreport/sos/archive/refs/tags/4.8.0.tar.gz

   Note: For the latest version of sosreport, see version releases on the GitHub website.

2. To generate the sos report, run the following command:

   /usr/local/bin/sos report --batch

3. To navigate to the sosreport tar file, run the following command:

   cd /var/tmp/

4. To exit from the chroot environment, run the following command:

   exit

5. Then, run the following command to unmount /dev, /run, /proc, and /sys:

   sudo umount /mnt/{dev,proc,run,sys,}

6. The sosreport file is located in /mnt/var/tmp. The file has the following naming convention: sosreport-ip-x-x-x-x-yyyy-mm-dd-pwgxswy.tar.xz.
   Note: Replace x-x-x-x with the IP address and -yyyy-mm-dd with the date.

Related information

Troubleshoot issues with Amazon EC2 instances

How do I use EC2Rescue for Linux to troubleshoot operating system-level issues?