Linux servers come with lots of system monitoring utilities preinstalled. However, RHEL-based servers don’t include the sysstat collection. Among others, sysstat includes
iostat. We use both utilities a lot. In particular
sar is useful, as it let’s you view historic resource usage.
For this article I am using a RHEL8-based server. There are some difference between how sysstat is configured on RHEL7 and 8 but the basics are the same.
Installing sysstat is very easy. The package is available from the default repositories, so you can use either Yum or DNF to install it:
# dnf update # dnf install sysstat
Next, you need to enable
sysstat. The command
systemctl enable --now does both. It enables the service so that it always starts when the server is booted, and it also starts the service now:
# systemctl enable --now sysstat # systemctl status sysstat ● sysstat.service - Resets System Activity Logs Loaded: loaded (/usr/lib/systemd/system/sysstat.service; enabled; vend> Active: active (exited) since Wed 2021-05-26 14:44:53 BST; 5s ago Process: 8478 ExecStart=/usr/lib64/sa/sa1 --boot (code=exited, status=0> Main PID: 8478 (code=exited, status=0/SUCCESS) May 26 14:44:53 almalinux.vm systemd: Starting Resets System Activit> May 26 14:44:53 almalinux.vm systemd: Started Resets System Activity>
The default configuration is sensible. Out of the box, data is collected every ten minutes and kept for 28 days. If you are happy with that then you don’t need to do anything else. Or well, you might want to learn how use utilities such sar.
You can of course change the defaults. Let’s first look at the data collection interval.
RHEL8-based systems use a systemd timer to set the interval. systemd timers are an alternative for cron jobs. They are more configurable but also more complicated. However, the sysstat timer is fairly easy to understand:
# cat /usr/lib/systemd/system/sysstat-collect.timer ... # sysstat-11.7.3 systemd unit file: # Activates activity collector every 10 minutes [Unit] Description=Run system activity accounting tool every 10 minutes [Timer] OnCalendar=*:00/10 [Install] WantedBy=sysstat.service
OnCalendar defines the interval. In this case sysstat collects data every ten minutes. WantedBy defines that the timer should be active when the sysstat.service is running.
You should never edit systemd unit files in /usr/lib/systemd/. Instead, you can create an override file in /etc/systemd/system/. The command to use is
systemctl edit. So, to edit the sysstat timer you can use
systemctl edit sysstat-collect.timer.
The command will open the default editor, and the file is automatically saved in the correct location. After the file has been saved the output of
systemctl status should show the new configuration file. Here, I changed the interval to one minute:
# systemctl status sysstat-collect.timer ● sysstat-collect.timer - Run system activity accounting tool every 1 minute Loaded: loaded (/usr/lib/systemd/system/sysstat-collect.timer; enabled; vendor preset: disabled) Drop-In: /etc/systemd/system/sysstat-collect.timer.d └─override.conf Active: active (waiting) since Wed 2021-05-26 14:44:53 BST; 34min ago Trigger: Wed 2021-05-26 15:20:00 BST; 27s left
And of course, you can also check if everything is working via journalctl:
# journalctl -g sysstat-collect.service ... May 26 15:21:00 almalinux.vm systemd: sysstat-collect.service: Succeeded. May 26 15:22:00 almalinux.vm systemd: sysstat-collect.service: Succeeded. May 26 15:23:00 almalinux.vm systemd: sysstat-collect.service: Succeeded. May 26 15:24:00 almalinux.vm systemd: sysstat-collect.service: Succeeded. May 26 15:25:00 almalinux.vm systemd: sysstat-collect.service: Succeeded. May 26 15:26:28 almalinux.vm systemd: sysstat-collect.service: Succeeded.
As for the interval value, 10 minutes is a good default. On new systems I sometimes change the value to 5 or 1. A lower interval gives you more data, which is useful if you need to closely monitor a server.
As said, by default data is kept for 28 days. This setting is defined in the configuration file. The file is remarkably short – it has just four variables:
# cat /etc/sysconfig/sysstat # sysstat-10.1.5 configuration file. # How long to keep log files (in days). # If value is greater than 28, then log files are kept in # multiple directories, one for each month. HISTORY=28 # Compress (using gzip or bzip2) sa and sar files older than (in days): COMPRESSAFTER=31 # Parameters for the system activity data collector (see sadc manual page) # which are used for the generation of log files. SADC_OPTIONS="-S DISK" # Compression program to use. ZIP="bzip2"
The only variable you might want to tweak is HISTORY. By default, data files are kept for 28 days. If you want to keep data for longer then you can increase the number.
sysstat you can more or less reverse the earlier steps. To do things cleanly you can first stop and disable the service before you uninstall the package:
# systemctl disable --now sysstat # dnf remove sysstat