Goose in RHEL 9.8: How Red Hat's AI agent is changing Linux system diagnostics

MarGib July 11, 2026

🌐 🇵🇱 Polski · 🇬🇧 EN

Red Hat has introduced an AI agent named Goose to RHEL 9.8, designed to revolutionize troubleshooting in Linux systems. Will this tool truly simplify the work of administrators, or will it just add another layer to an already complex diagnostic ecosystem?

Ilustracja agenta AI Goose analizującego logi systemowe w terminalu Linux na serwerze — Goose AI agent in action: automated log analysis in RHEL 9.8

Why did Goose appear in RHEL 9.8?

Linux system administrators have been struggling with the same problem for years: log analysis and error diagnostics are time-consuming tasks that require deep knowledge and experience. Red Hat decided to change this by introducing an AI agent called Goose in May 2024, built directly into RHEL 9.8. This tool aims to automate the process of diagnosing issues, from kernel errors to package conflicts, using distributed AI inference.

Goose is not just another monitoring tool – it is an attempt to shift the burden of analysis from humans to algorithms. In practice, this means that instead of manually searching through logs to find the root cause of an error, an administrator can rely on recommendations generated by the AI model. Does this mean the end of traditional diagnostics? Not necessarily, but it certainly changes the way we approach troubleshooting.

How does Goose work and what can it do?

Analyzed data and information sources

Goose collects and analyzes data from various system sources:

System logs: journalctl, /var/log/messages, dmesg.
Configurations: files from the /etc/ directory, systemd settings, service configurations.
Performance metrics: CPU, RAM, disk, and network usage (integration with pcp and Grafana).
Diagnostic reports: data from tools such as sosreport or crash.

Importantly, Goose operates in two modes:

Local mode: analysis takes place directly on the server without sending data to the cloud. This is a solution for those who care about privacy or work in environments with strict security requirements.
Cloud mode (Red Hat Insights): data is synchronized with the Red Hat cloud, which allows for more advanced analysis but requires acceptance of the privacy policy.

AI model and its limitations

Goose uses distributed AI inference, meaning calculations can be performed both locally and in the cloud, depending on the configuration. Unfortunately, Red Hat does not provide details on the model architecture. It is unclear whether it is a Large Language Model (LLM) or another type of neural network. However, it is known that:

The model is closed-source and not available as open source.
It requires at least 2 GB of RAM (4 GB recommended for larger environments).
It only runs on x86_64 and ARM64 architectures – there is no support for IBM Power or s390x.

The lack of technical details raises some concerns, especially among administrators who prefer open-source solutions. Will Goose become another "black box" in the RHEL ecosystem? Time will tell.

Practical use cases for Goose

Goose is not a universal tool, but it can significantly speed up the resolution of specific problems. Here are a few examples where it might prove helpful:

1. Kernel errors and memory issues

Errors such as OOM killer (Out of Memory) or kernel panic are every administrator's nightmare. Goose analyzes dmesg and journalctl logs, identifying patterns that indicate memory issues. It then suggests optimizing parameters such as vm.swappiness or oom_score_adj. This can save hours of manual analysis.

2. Disk performance issues

High iowait or slow I/O operations can significantly degrade system performance. Goose detects such anomalies and proposes changes to the I/O scheduler (e.g., switching from cfq to deadline). This solution is particularly useful in environments where disks are under heavy load.

3. Package conflicts and dependencies

After system updates, conflicts between packages often occur, e.g., incompatible versions of glibc libraries. Goose analyzes dependencies and suggests solutions, such as downgrading a package or installing an alternative version.

4. systemd service errors

Service startup issues, such as Failed to start service, can be difficult to diagnose. Goose checks service logs, configurations, and dependencies, pointing out potential causes of errors.

5. Security vulnerability detection

Goose scans configurations for potential vulnerabilities, e.g., insecure settings in sshd_config (such as PermitRootLogin yes) or outdated packages. This does not replace dedicated security audit tools, but it can be a useful supplement.

So far, there is a lack of public case studies from companies using Goose, but Red Hat promises to publish such reports in the second half of 2024. It is worth following this information to see how the tool performs in real production environments.

Goose vs. traditional diagnostic tools

Goose is not the first Linux system diagnostic tool, but it introduces a new quality – an AI layer. How does it compare to existing solutions?

Tool	Pros	Cons	Complementarity with Goose
sosreport	Full system snapshot, useful for offline analysis.	No AI, requires manual interpretation.	Goose can analyze data from `sosreport`.
Cockpit	Web interface for monitoring and management.	Limited log analysis, no AI.	Goose complements Cockpit with advanced analysis.
Prometheus + Grafana	Advanced metrics and alerts.	No log context, requires manual configuration.	Goose can utilize Prometheus metrics.
ELK Stack	Log centralization, advanced searching.	Complex configuration, resource-intensive.	Goose can operate on data from Elasticsearch.
Red Hat Insights	Cloud analysis and recommendations.	Requires sending data to the cloud.	Goose can operate locally, Insights in the cloud.

Goose does not replace existing tools, but integrates with them, adding a layer of automated analysis. Its greatest advantage is the ability to detect patterns in logs that traditional tools might miss. For example, while Prometheus might alert on high CPU usage, Goose can point to the specific cause – e.g., an application bug or suboptimal configuration.

How to deploy Goose in RHEL 9.8?

Requirements and installation

To use Goose, you need:

An active Red Hat Enterprise Linux subscription.
RHEL 9.8 or newer.
At least 2 GB of RAM (4 GB recommended).

Installation is simple and is performed using the dnf package manager:

# Włącz repozytoria
sudo subscription-manager repos --enable rhel-9-for-x86_64-appstream-rpms
sudo subscription-manager repos --enable rhel-9-for-x86_64-baseos-rpms

# Zainstaluj pakiet goose
sudo dnf install goose

# Uruchom usługę
sudo systemctl enable --now goose

Configuration and first steps

After installation, Goose runs in local mode by default. The configuration file is located in /etc/goose/goose.conf. To enable integration with Red Hat Insights, run:

sudo goose insights --enable

Basic commands:

sudo goose analyze --logs /var/log/messages – analyze a specific log file.
sudo goose diagnose --service httpd – diagnose a service issue with httpd.
sudo goose report --output /tmp/goose_report.html – generate a report in HTML format.

Limitations and notes

Goose does not support containers – for now, it only works on RHEL hosts.
Requires internet access during the first configuration (to download the AI model).
No support for older RHEL versions (e.g., RHEL 8).

The future of Goose: What is Red Hat planning?

Red Hat has announced several key changes and extensions for Goose in the coming years:

2024: Integration with Ansible and OpenShift

Ansible: Automatic remediation based on Goose recommendations. For example, if Goose detects a service configuration error, Ansible can automatically apply fixes.
OpenShift: Diagnosing issues in Kubernetes clusters. This is an important extension, given the growing popularity of OpenShift in enterprise environments.

2025: Expansion to other distributions

Red Hat has not yet officially confirmed whether Goose will appear in Fedora or CentOS Stream, but such plans seem likely. However, the lack of support for other distributions may be a problem for administrators using hybrid environments.

Specialized AI models

In the future, Red Hat plans to add models specialized for specific tasks, e.g., diagnosing PostgreSQL databases or network services. This could make Goose an even more useful tool.

Risks and challenges associated with Goose

Data privacy

Goose in local mode does not send data outside the server, which is a major plus for environments with strict security requirements. However, in Red Hat Insights mode, logs are sent to the Red Hat cloud. Although the company declares data anonymization, the lack of technical details may raise doubts, especially in the context of regulations such as GDPR or HIPAA.

Security

Goose requires root privileges, which means that if a server is compromised, an attacker could use the tool to spy on the system.
No public security audits conducted by third-party firms.
Red Hat ensures that data is stored in data centers compliant with SOC2 and ISO 27001, but does not provide implementation details.

Dependency on a closed ecosystem

Goose is a closed-source tool and requires a Red Hat subscription. This may be a problem for administrators using RHEL clones such as CentOS or Rocky Linux. Will Red Hat decide to open-source the code? There are no such plans for now.

Summary: Is it worth deploying Goose?

Goose is a promising tool that can significantly speed up troubleshooting in RHEL systems. Its greatest advantage is automated log analysis and suggestion of solutions, which saves administrators time. However, it is not a universal tool – it still requires manual verification of recommendations, especially in complex environments.

It is worth considering deploying Goose if:

You work in an RHEL 9.8 environment and have an active Red Hat subscription.
You frequently struggle with issues that require log analysis (e.g., kernel errors, service issues).
You want to automate part of the diagnostic process without giving up control over the system.

Goose will not replace an experienced administrator, but it can become a valuable assistant. It is worth following its development, especially in the context of planned integrations with Ansible and OpenShift.

If you are interested in the topic of diagnostic automation, also check out our article on Linux log analysis and Bash scripts for server automation.