From 71cdbde72f81d586da37a9e108868d6aa1b4ef69 Mon Sep 17 00:00:00 2001
From: Pavel Moravec <pmoravec@redhat.com>
Date: Thu, 5 Dec 2019 14:26:03 +0100
Subject: [PATCH] [plugins] improve heuristic for applying --since to
 logarchives

logarchive_pattern treats some configs (e.g. /etc/dbus-1) as log
archives, causing --since option will skip collecting them.

This patch just improves the heuristic by claiming nothing under /etc
is a logarchive, and adds a warning to sosreport help.

Improves: #1847

Signed-off-by: Pavel Moravec <pmoravec@redhat.com>
---
 man/en/sosreport.1      | 5 ++++-
 sos/plugins/__init__.py | 5 ++++-
 2 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/man/en/sosreport.1 b/man/en/sosreport.1
index a885d5630..f63b8deab 100644
--- a/man/en/sosreport.1
+++ b/man/en/sosreport.1
@@ -158,8 +158,11 @@ and including logs in non-default locations. This option may significantly
 increase the size of reports.
 .TP
 .B \--since YYYYMMDD[HHMMSS]
-Limits the collection to logs newer than this date.
+Limits the collection of log archives(*) to those newer than this date.
 This also affects \--all-logs. Will pad with 0s if HHMMSS isn't specified.
+(*) Sos interprets as a log archive any file not found in /etc, that has
+either a numeric or compression-type extension for example '.zip'. '.1', '.gz'
+ etc.)
 .TP
 .B \--allow-system-changes
 Run commands even if they can change the system (e.g. load kernel modules).
diff --git a/sos/plugins/__init__.py b/sos/plugins/__init__.py
index b7a47b6a4..44ae413d0 100644
--- a/sos/plugins/__init__.py
+++ b/sos/plugins/__init__.py
@@ -917,6 +917,7 @@ def add_copy_spec(self, copyspecs, sizelimit=None, maxage=None,
             since = self.get_option('since')
 
         logarchive_pattern = re.compile(r'.*((\.(zip|gz|bz2|xz))|[-.][\d]+)$')
+        configfile_pattern = re.compile(r"^%s/*" % self.join_sysroot("etc"))
 
         if not self.test_predicate(pred=pred):
             self._log_info("skipped copy spec '%s' due to predicate (%s)" %
@@ -962,7 +963,9 @@ def time_filter(path):
                 """ When --since is passed, or maxage is coming from the
                 plugin, we need to filter out older files """
 
-                if logarchive_pattern.search(path) is None:
+                # skip config files or not-logarchive files from the filter
+                if ((logarchive_pattern.search(path) is None) or
+                   (configfile_pattern.search(path) is not None)):
                     return True
                 filetime = datetime.fromtimestamp(getmtime(path))
                 if ((since and filetime < since) or