(copied from #16680 - that will be reference by changes in katello, this for PR in foreman project)

Description of problem:
Currently foreman-debug truncates any (log)file it collects after 5000 lines, to shrink the size of created tarball. This causes the problem that collected logs have "gaps" in timeline, what means we lose track of events happened that time.

Assume I want to investigate some problem with relevant logs scattered in past 2 days, and these logs are kept in files A.log, A.1.log and A.2.log, each exceeding 5k lines. Then I get tails of the logfiles (plus tails of A.9999.log from very past) but dont know what happened at the beginning of say A.1.log.

So we don't collect some log records in close history while we collect some logs in very past history.

What about to rather collect all newest files, until some per-directory limit is reached?

Something like that is done in sosreport [1] where it works well.

[1] https://github.com/sosreport/sos/blob/master/sos/plugins/__init__.py#L508​

Version-Release number of selected component (if applicable):
foreman-debug-1.11.0.49-1.el7sat.noarch

How reproducible:
100%

Steps to Reproduce:
1. Generate logfiles (i.e. production.log*) each bigger than 5k lines
2. collect foreman-debug and unpack it
3. Check what logfiles are collected

Actual results:
Currently tails of all logfiles (even 2 years old, irrelevant for current problem investigation) are collected. But head of first log-rotated logfile is missing (causing we dont know what happened yesterday morning)

Expected results:
Collected logifles completely cover past few days without a gap; older logfiles not collected.

Additional info: