SYSSTAT(5)

📦
version 12.8.0 · 7 versions
, in arch rolling

💖 SYSSTAT(5) 💖

okay so this is the sysstat config file page, from the Linux User's Manual bestie. sit down, grab a strawberry 🍓, we're doing this.

✨ NAME ✨

sysstat — literally just the sysstat configuration file, that's it, that's the vibe.

🌸 DESCRIPTION 🌸

So this file gets read by the sa1(8) and sa2(8) shell scripts from the sysstat tool set. It's basically just a sequence of shell variable assignments that configure sysstat logging — no cap, that's the whole thing. Here are the variables and what they mean, bestie:

  • COMPRESSAFTER — the number of days after which daily data files get compressed. the compression program used is the one you put in the ZIP variable. 🗜️
  • DELAY_RANGE — tells the sa2 script to wait for a random delay in the range you indicate before running. it's in seconds, and the whole point is to prevent a massive I/O burst happening at the same time on VMs that share the same storage area. a value of 0 means the sa2 script generates its report files immediately. ⏳
  • HISTORY — the number of days a daily data file or a report should be kept. data files or reports older than this number of days get removed by the sa2(8) shell script. data files and reports are normally saved in the /var/log/sa directory, under the name saDD (for data files) or sarDD (for reports), where the DD parameter indicates the current day.
heads up: the number of files actually kept in the /var/log/sa directory may be slightly higher than the HISTORY value, because of the way the sa2 script figures out which files are to be removed (see below, "How the sa2(8) script applies HISTORY value"). using a value of 28 keeps a whole month's worth of data. if you set HISTORY to a value greater than 28 then you should consider using sadc's option -D to prevent older data files from being overwritten (see the sadc(8) manual page). in this latter case data files are named saYYYYMMDD and reports sarYYYYMMDD, where YYYY stands for the current year, MM for the current month and DD for the current day. 📅

🎀 How the sa2(8) script applies HISTORY value 🎀

okay this part is kind of iconic honestly. the sa2 script uses the find command with the -mtime option to figure out which files are to be removed. the find command interprets this value as "N 24 hour periods", ignoring any fractional part.

which means: the last modified time of a given sa[r]DD data or report file, using a HISTORY of 1, has to have been modified at least two days ago before it will be removed. and for a HISTORY of 28 that would mean 29 days ago. 😭

to figure out how a HISTORY of 28 is applied in practice, we need to consider that the sa2 script that issues the find command to remove the old files typically runs just before midnight on a given system, and since the first record from sadc can also be written to the previous day's data file (thereby moving its modification time up a bit), the sa2 script will leave 30 files untouched. so for a setting of 28, and counting the data file of the current day, there will always be 31 files (or 30 files, depending on the number of days in a month) in the /var/log/sa directory during the majority of a given day. e.g.:

April 30th: 31 files (Apr 30th-1st, Mar 31th)
May 1st: 30 files (May 1st, Apr 30th-2nd)

yet we can note the following exceptions (as inspected at Noon of the given day):

February 28th: 31 files (Feb 28th-1st, Jan 31st, 30th & 29th)
March 1st: 30 files (Mar 1st, Feb 28th-2nd, Jan 31st & 30th)
March 2nd: 29 files (Mar 1st & 2nd, Feb 28th-3rd, Jan. 31st)
March 3rd: 28 files (Mar 1st-3rd, Feb 28th-4th)
March 4th - March 28th: 28 files
March 29th: 29 files
March 30th: 30 files
March 31st: 31 files

(determining the number of files in March on a leap year is left as an exercise for the reader 💀 iconic of them honestly)

things are simpler if you use the sa[r]YYYYMMDD name format. apply the same logic as above in this case and you will find that there are always HISTORY + 3 files in the /var/log/sa directory during the majority of a given day. slay ✨

  • REPEAT_HEADER — the maximum number of lines after which a header will be inserted in the report generated by the sa2 script. by default there's only a header at the beginning of each report and it is not repeated afterwards. 📄
  • REPORTS — set this variable to false to prevent the sa2 script from generating reports (the sarDD files). 🚫
  • SA_DIR — directory where the standard system activity daily data and report files are saved. its default value is /var/log/sa. 📁
  • SADC_OPTIONS — options that should be passed to sadc(8). with these options (see the sadc(8) manual page), you can select some additional data which are going to be saved in daily data files. these options are used only when a new data file is created — they will be ignored with an already existing one. ⚠️
  • UMASK — the sa1 and sa2 scripts generate system activity data and report files in the /var/log/sa directory. by default the files are created with umask 0022 and are therefore readable for all users. change this variable to restrict the permissions on the files (e.g. use 0027 to adhere to more strict security standards). 🔒
  • YESTERDAY — by default the sa2 script generates yesterday's summary, since the cron job usually runs right after midnight. if you want sa2 to generate the summary of the same day (for example when the cron job runs at 23:53) set this variable to no. 🌙
  • ZIP — the program used to compress data and report files. 🗜️

🦋 FILE 🦋

/etc/conf.d/sysstat

👑 AUTHOR 👑

Sebastien Godard (sysstat <at> orange.fr)

🌈 SEE ALSO 🌈

sadc(8), sa1(8), sa2(8)

https://github.com/sysstat/sysstat
https://sysstat.github.io/

and that's the page bestie 🫶 it's from Linux, dated AUGUST 2023, and it's SYSSTAT(5) — go configure ur logging, you've got this 💅✨

📦 where this page comes from