Being a good sysadmin, you should comb through your logs periodically… Even better, get a log analyzer. With that comes questions. Why did daemon X do Y at time Z. Well, if it has been too long, you’re out of luck. Sometimes the sar data can be the difference you need to answer those questions. But it only saves one month worth.
 

How can we update sysstat to retain more than the default?

[root@b08s02ur ~]# grep HISTORY /etc/sysconfig/sysstat
HISTORY=180
[root@b08s02ur ~]# systemctl restart sysstat
[root@b08s02ur ~]#

We edit the config file, and increase the HISTORY directive.  

If we now take a look at the /var/log/sa directory, the structure has even been updated.

[root@b08s02ur sa]# ls -l | grep 2017
drwxr-xr-x 2 root root   4096 Sep 21 00:00 201709
lrwxrwxrwx 1 root root     11 Sep 20 23:50 sa20 -> 201709/sa20
lrwxrwxrwx 1 root root     11 Sep 21 10:54 sa21 -> 201709/sa21
lrwxrwxrwx 1 root root     12 Sep 20 23:53 sar20 -> 201709/sar20
[root@b08s02ur sa]#

 

The way the directory structure updates is actually pretty ingenius. Previously all of the data resided in this directory. To support more than 30 days, it now creates a directory /var/log/sa/$YEAR$MONTH/. Each file is a symlink into the current month. Honestly, that is super clever.  

 

Related Posts