+kirtika as an fyi.

does mcelog need to be running on the system all the time, or at all ?  isn't there a raw log we can just save & upload and do the analysis on the server side ?

we really dislike doing any local processing if we can avoid it.

We could use something like https://github.com/thockin/mcedaemon and upload for later decoding.

we can't get away from running a persistent daemon though ?  ideally a MCE would be noticed either by a udev event or via the existing crash anomaly collector (which parses the kernel/syslog stream), and then that event would kick off the MCE data collection.

a glance at the docs suggests that MCEs are processed via a blocking read/poll on /dev/mcelog.  i guess we're stuck with adding another daemon.  at least it'd only use up RAM resources at runtime though in the normal case.

adding a new crash handler type to crash-reporter shouldn't be too hard, and then we'd add a handler to /etc/mced/ which would call crash-reporter with the right flags/etc...

will need to update the PDD to describe this new source of data, and document PII/etc... that is collected.