Last updated:
Linux servers come with lots of system monitoring utilities preinstalled. However, RHEL-based servers don’t include the sysstat collection. Among others, sysstat includes sar
and iostat
.
In this article I look at installing sysstat
and configuring sar
on a RHEL8-based server. There are some difference between how sysstat is configured on RHEL7 and 8 but the basics are the same.
Installing sysstat
is easy. The package is available from the default repositories, so you can use either DNF (or Yum, if you use RHEL7) to install it:
# dnf update # dnf install sysstat
Next, you need to enable sysstat
. The command systemctl enable --now
does both: it enables the service so that it always starts when the server is booted, and it also starts the service now:
# systemctl enable --now sysstat # systemctl status sysstat ● sysstat.service - Resets System Activity Logs Loaded: loaded (/usr/lib/systemd/system/sysstat.service; enabled; vend> Active: active (exited) since Wed 2021-05-26 14:44:53 BST; 5s ago Process: 8478 ExecStart=/usr/lib64/sa/sa1 --boot (code=exited, status=0> Main PID: 8478 (code=exited, status=0/SUCCESS) May 26 14:44:53 almalinux.vm systemd[1]: Starting Resets System Activit> May 26 14:44:53 almalinux.vm systemd[1]: Started Resets System Activity>
The default configuration is sensible. Out of the box, data is collected every ten minutes and kept for 28 days. If you are happy with that then you don’t need to do anything else. Or well, you might want to learn how use utilities such sar.
You can of course change the defaults. Let’s first look at the data collection interval.
RHEL8-based systems use a systemd timer to set the interval. systemd timers are an alternative for cron jobs. They are more configurable but also more complicated. However, the sysstat
timer is fairly easy to understand:
# cat /usr/lib/systemd/system/sysstat-collect.timer ... # sysstat-11.7.3 systemd unit file: # Activates activity collector every 10 minutes [Unit] Description=Run system activity accounting tool every 10 minutes [Timer] OnCalendar=*:00/10 [Install] WantedBy=sysstat.service
OnCalendar defines the interval. In this case data is collected every ten minutes. WantedBy defines that the timer should be active when the sysstat.service is running.
You should never edit systemd unit files in /usr/lib/systemd/ as your changes could be overwritten when your system is updated. Instead, you can use the command systemctl edit
to create an override file in /etc/systemd/system/. So, to edit the timer you can use systemctl edit sysstat-collect.timer
. The command opens the default editor, and the file is automatically saved in the correct location.
After you have saved the file you should see the new configuration listed in the output of systemctl status
. Here, I changed the interval to one minute:
# systemctl status sysstat-collect.timer ● sysstat-collect.timer - Run system activity accounting tool every 1 minute Loaded: loaded (/usr/lib/systemd/system/sysstat-collect.timer; enabled; vendor preset: disabled) Drop-In: /etc/systemd/system/sysstat-collect.timer.d └─override.conf Active: active (waiting) since Wed 2021-05-26 14:44:53 BST; 34min ago Trigger: Wed 2021-05-26 15:20:00 BST; 27s left
And of course, you can also check if everything is working via journalctl:
# journalctl -g sysstat-collect.service ... May 26 15:21:00 almalinux.vm systemd[1]: sysstat-collect.service: Succeeded. May 26 15:22:00 almalinux.vm systemd[1]: sysstat-collect.service: Succeeded. May 26 15:23:00 almalinux.vm systemd[1]: sysstat-collect.service: Succeeded. May 26 15:24:00 almalinux.vm systemd[1]: sysstat-collect.service: Succeeded. May 26 15:25:00 almalinux.vm systemd[1]: sysstat-collect.service: Succeeded. May 26 15:26:28 almalinux.vm systemd[1]: sysstat-collect.service: Succeeded.
As for the interval value, 10 minutes is a good default. On new systems I sometimes change the value to 5 or 1. A lower interval gives you more data, which is useful if you need to closely monitor a server.
As said, by default data is kept for 28 days. This setting is defined in the configuration file. The file is remarkably short – it has just four variables:
# cat /etc/sysconfig/sysstat # sysstat-10.1.5 configuration file. # How long to keep log files (in days). # If value is greater than 28, then log files are kept in # multiple directories, one for each month. HISTORY=28 # Compress (using gzip or bzip2) sa and sar files older than (in days): COMPRESSAFTER=31 # Parameters for the system activity data collector (see sadc manual page) # which are used for the generation of log files. SADC_OPTIONS="-S DISK" # Compression program to use. ZIP="bzip2"
The only variable you might want to tweak is HISTORY. By default, data files are kept for 28 days. If you want to keep data for longer then you can increase the number.
To remove sysstat
you can more or less reverse the earlier steps. To do things cleanly you can first stop and disable the service before you uninstall the package:
# systemctl disable --now sysstat # dnf remove sysstat