How to install and configure sysstat

Last updated: 18 September 2021

Linux servers come with lots of system monitoring utilities preinstalled. However, RHEL-based servers don’t include the sysstat collection. Among others, sysstat includes sar and iostat.

In this article I look at installing sysstat and configuring sar on a RHEL8-based server. There are some difference between how sysstat is configured on RHEL7 and 8 but the basics are the same.

Installing sysstat

Installing sysstat is easy. The package is available from the default repositories, so you can use either DNF (or Yum, if you use RHEL7) to install it:

# dnf update
# dnf install sysstat

Next, you need to enable sysstat. The command systemctl enable --now does both: it enables the service so that it always starts when the server is booted, and it also starts the service now:

# systemctl enable --now sysstat

# systemctl status sysstat
● sysstat.service - Resets System Activity Logs
   Loaded: loaded (/usr/lib/systemd/system/sysstat.service; enabled; vend>
   Active: active (exited) since Wed 2021-05-26 14:44:53 BST; 5s ago
  Process: 8478 ExecStart=/usr/lib64/sa/sa1 --boot (code=exited, status=0>
 Main PID: 8478 (code=exited, status=0/SUCCESS)

May 26 14:44:53 almalinux.vm systemd[1]: Starting Resets System Activit>
May 26 14:44:53 almalinux.vm systemd[1]: Started Resets System Activity>

Configuring sysstat

The default configuration is sensible. Out of the box, data is collected every ten minutes and kept for 28 days. If you are happy with that then you don’t need to do anything else. Or well, you might want to learn how use utilities such sar.

You can of course change the defaults. Let’s first look at the data collection interval.

Changing the interval

RHEL8-based systems use a systemd timer to set the interval. systemd timers are an alternative for cron jobs. They are more configurable but also more complicated. However, the sysstat timer is fairly easy to understand:

# cat /usr/lib/systemd/system/sysstat-collect.timer
...
# sysstat-11.7.3 systemd unit file:
#        Activates activity collector every 10 minutes

[Unit]
Description=Run system activity accounting tool every 10 minutes

[Timer]
OnCalendar=*:00/10

[Install]
WantedBy=sysstat.service

OnCalendar defines the interval. In this case data is collected every ten minutes. WantedBy defines that the timer should be active when the sysstat.service is running.

You should never edit systemd unit files in /usr/lib/systemd/ as your changes could be overwritten when your system is updated. Instead, you can use the command systemctl edit to create an override file in /etc/systemd/system/. So, to edit the timer you can use systemctl edit sysstat-collect.timer. The command opens the default editor, and the file is automatically saved in the correct location.

After you have saved the file you should see the new configuration listed in the output of systemctl status. Here, I changed the interval to one minute:

# systemctl status sysstat-collect.timer
● sysstat-collect.timer - Run system activity accounting tool every 1 minute
   Loaded: loaded (/usr/lib/systemd/system/sysstat-collect.timer; enabled; vendor preset: disabled)
  Drop-In: /etc/systemd/system/sysstat-collect.timer.d
           └─override.conf
   Active: active (waiting) since Wed 2021-05-26 14:44:53 BST; 34min ago
  Trigger: Wed 2021-05-26 15:20:00 BST; 27s left

And of course, you can also check if everything is working via journalctl:

# journalctl -g sysstat-collect.service
...
May 26 15:21:00 almalinux.vm systemd[1]: sysstat-collect.service: Succeeded.
May 26 15:22:00 almalinux.vm systemd[1]: sysstat-collect.service: Succeeded.
May 26 15:23:00 almalinux.vm systemd[1]: sysstat-collect.service: Succeeded.
May 26 15:24:00 almalinux.vm systemd[1]: sysstat-collect.service: Succeeded.
May 26 15:25:00 almalinux.vm systemd[1]: sysstat-collect.service: Succeeded.
May 26 15:26:28 almalinux.vm systemd[1]: sysstat-collect.service: Succeeded.

As for the interval value, 10 minutes is a good default. On new systems I sometimes change the value to 5 or 1. A lower interval gives you more data, which is useful if you need to closely monitor a server.

Changing how long data is kept

As said, by default data is kept for 28 days. This setting is defined in the configuration file. The file is remarkably short – it has just four variables:

# cat /etc/sysconfig/sysstat
# sysstat-10.1.5 configuration file.

# How long to keep log files (in days).
# If value is greater than 28, then log files are kept in
# multiple directories, one for each month.
HISTORY=28

# Compress (using gzip or bzip2) sa and sar files older than (in days):
COMPRESSAFTER=31

# Parameters for the system activity data collector (see sadc manual page)
# which are used for the generation of log files.
SADC_OPTIONS="-S DISK"

# Compression program to use.
ZIP="bzip2"

The only variable you might want to tweak is HISTORY. By default, data files are kept for 28 days. If you want to keep data for longer then you can increase the number.

Removing sysstat

To remove sysstat you can more or less reverse the earlier steps. To do things cleanly you can first stop and disable the service before you uninstall the package:

# systemctl disable --now sysstat
# dnf remove sysstat