--- title: Introducing the Red Hat OpenShift Virtualization... description: Red Hat introduced a new --vm-incident mode for the kubevirt/must-gather tool, designed to reduce VM incident investigation time compared to slow,... canonical: https://daily.dev/posts/introducing-the-red-hat-openshift-virtualization-incident-must-gather-yjohg2txb twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Introducing the Red Hat OpenShift Virtualization incident must-gather | daily.dev og:description: Red Hat introduced a new --vm-incident mode for the kubevirt/must-gather tool, designed to reduce VM incident investigation time compared to slow,... og:url: https://daily.dev/posts/introducing-the-red-hat-openshift-virtualization-incident-must-gather-yjohg2txb og:image: https://api.daily.dev/og/posts/YjOHG2Txb.png og:image:alt: Introducing the Red Hat OpenShift Virtualization incident must-gather og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Introducing the Red Hat OpenShift Virtualization incident must-gather **[Red Hat Developer](https://daily.dev/sources/rhdev)** · 3 min read · 0 upvotes · 0 comments ## Summary Red Hat introduced a new --vm-incident mode for the kubevirt/must-gather tool, designed to reduce VM incident investigation time compared to slow, resource-intensive cluster-wide must-gather runs. The mode scopes data collection to a specific VM, its node, and a time window around an incident, gathering host diagnostics, VM context, live hypervisor state (e.g., BSOD console output), pod logs, and Prometheus metrics into an archive with an incident-summary.yaml manifest. The structured, focused dataset is also positioned to aid AI-assisted root cause analysis. Usage is shown via the standard oc adm must-gather command with new NS, VM, and --incident-time arguments. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How do I use the new --vm-incident mode in kubevirt/must-gather to investigate a VM crash on OpenShift Virtualization? Run the standard must-gather command with the --vm-incident flag, specifying the namespace, VM name, and incident time in ISO-8601 UTC format, for example: oc adm must-gather --image=quay.io/kubevirt/must-gather -- NS=namespace VM=myvm /usr/bin/gather --vm-incident --incident-time=2026-07-16T10:00:00Z. It automatically scopes collection to the affected node and a window of 24 hours before to 2 hours after the incident. _daily.dev surfaces practical KubeVirt and OpenShift Virtualization operational guides like this as they emerge._ ### What data does the --vm-incident mode collect that a regular must-gather does not scope down to? It narrows collection to a specific VM, the node it ran on, and a defined incident time window, gathering host data (dmesg, journal, kubelet logs, storage/network diagnostics, kernel red-flags), VM/VMI definitions and storage chains, live hypervisor state such as virsh domain XML and guest console output if the VM hasn't rebooted, virt-launcher/virt-handler pod logs, and incident-specific Prometheus metrics. _Engineers troubleshooting VM outages can track tooling like this on daily.dev to cut investigation time._ ### Why does a traditional must-gather plus sosreport take so long when investigating a VM incident on OpenShift Virtualization? It gathers data across the entire cluster rather than isolating the specific VM, node, and time window involved, producing a large, resource-intensive dataset that takes hours to collect and is difficult to review efficiently. The newer --vm-incident mode addresses this by limiting scope to the affected VM, its node, and a time window around the incident. _daily.dev helps infrastructure teams keep up with incident-response tooling changes across virtualization platforms._ ## Similar posts on daily.dev - [Improved failure reports on Red Hat OpenShift with the event-driven diagnostic operator](https://daily.dev/posts/improved-failure-reports-on-red-hat-openshift-with-the-event-driven-diagnostic-operator-jlfpko67h) · Red Hat Developer · 0 upvotes · 0 comments - [Red Hat OpenShift Virtualization memory management overview](https://daily.dev/posts/red-hat-openshift-virtualization-memory-management-overview-sagtgphoy) · Red Hat Developer · 0 upvotes · 0 comments - [Medium](https://daily.dev/posts/medium-dkufogtuy) · Medium · 0 upvotes · 0 comments - [Red Hat Expands OpenShift Application Development Environment](https://daily.dev/posts/red-hat-expands-openshift-application-development-environment-9febxassl) · Cloud Native Now · 1 upvotes · 0 comments - [7 Open Source Incident Response Tools by Category](https://daily.dev/posts/7-open-source-incident-response-tools-by-category-yjlpker8m) · Orca Security Blog · 0 upvotes · 0 comments --- Tags: [#kubernetes](https://daily.dev/tags/kubernetes), [#infrastructure](https://daily.dev/tags/infrastructure), [#openshift](https://daily.dev/tags/openshift) [View this post on daily.dev](https://daily.dev/posts/introducing-the-red-hat-openshift-virtualization-incident-must-gather-yjohg2txb) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Introducing the Red Hat OpenShift Virtualization incident must-gather","url":"https://daily.dev/posts/introducing-the-red-hat-openshift-virtualization-incident-must-gather-yjohg2txb","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/introducing-the-red-hat-openshift-virtualization-incident-must-gather-yjohg2txb"},"datePublished":"2026-08-14T03:29:05.142Z","dateModified":"2026-09-14T08:32:56.820Z","description":"Red Hat introduced a new --vm-incident mode for the kubevirt/must-gather tool, designed to reduce VM incident investigation time compared to slow,...","image":"https://media.daily.dev/image/upload/s--ZrL_HSsR--/f_auto/v1722860399/public/Placeholder%2006","thumbnailUrl":"https://media.daily.dev/image/upload/s--ZrL_HSsR--/f_auto/v1722860399/public/Placeholder%2006","isAccessibleForFree":true,"articleSection":"Red Hat Developer","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Red Hat Developer","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/2a8895f3216c4900bdc455585a4ad3e4","url":"https://daily.dev/sources/rhdev"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/introducing-the-red-hat-openshift-virtualization-incident-must-gather-yjohg2txb","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"kubernetes,infrastructure,openshift","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Red Hat Developer","item":"https://daily.dev/sources/rhdev"},{"@type":"ListItem","position":3,"name":"Introducing the Red Hat OpenShift Virtualization incident must-gather"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/introducing-the-red-hat-openshift-virtualization-incident-must-gather-yjohg2txb#faq","mainEntity":[{"@type":"Question","name":"How do I use the new --vm-incident mode in kubevirt/must-gather to investigate a VM crash on OpenShift Virtualization?","acceptedAnswer":{"@type":"Answer","text":"Run the standard must-gather command with the --vm-incident flag, specifying the namespace, VM name, and incident time in ISO-8601 UTC format, for example: oc adm must-gather --image=quay.io/kubevirt/must-gather -- NS=namespace VM=myvm /usr/bin/gather --vm-incident --incident-time=2026-07-16T10:00:00Z. It automatically scopes collection to the affected node and a window of 24 hours before to 2 hours after the incident. daily.dev surfaces practical KubeVirt and OpenShift Virtualization operational guides like this as they emerge."}},{"@type":"Question","name":"What data does the --vm-incident mode collect that a regular must-gather does not scope down to?","acceptedAnswer":{"@type":"Answer","text":"It narrows collection to a specific VM, the node it ran on, and a defined incident time window, gathering host data (dmesg, journal, kubelet logs, storage/network diagnostics, kernel red-flags), VM/VMI definitions and storage chains, live hypervisor state such as virsh domain XML and guest console output if the VM hasn't rebooted, virt-launcher/virt-handler pod logs, and incident-specific Prometheus metrics. Engineers troubleshooting VM outages can track tooling like this on daily.dev to cut investigation time."}},{"@type":"Question","name":"Why does a traditional must-gather plus sosreport take so long when investigating a VM incident on OpenShift Virtualization?","acceptedAnswer":{"@type":"Answer","text":"It gathers data across the entire cluster rather than isolating the specific VM, node, and time window involved, producing a large, resource-intensive dataset that takes hours to collect and is difficult to review efficiently. The newer --vm-incident mode addresses this by limiting scope to the affected VM, its node, and a time window around the incident. daily.dev helps infrastructure teams keep up with incident-response tooling changes across virtualization platforms."}}]} ```