Being a good sysadmin, you should comb through your logs periodically… Even better, get a log analyzer. With that comes questions. Why did daemon X do Y at time Z. Well, if it has been too long, you’re out of luck. Sometimes the sar data can be the difference you need to answer those questions. But it only saves one month worth.
How can we update sysstat to retain more than the default?
[root@b08s02ur ~]# grep HISTORY /etc/sysconfig/sysstat HISTORY=180 [root@b08s02ur ~]# systemctl restart sysstat [root@b08s02ur ~]#
We edit the config file, and increase the HISTORY directive.
If we now take a look at the /var/log/sa directory, the structure has even been updated.
[root@b08s02ur sa]# ls -l | grep 2017 drwxr-xr-x 2 root root 4096 Sep 21 00:00 201709 lrwxrwxrwx 1 root root 11 Sep 20 23:50 sa20 -> 201709/sa20 lrwxrwxrwx 1 root root 11 Sep 21 10:54 sa21 -> 201709/sa21 lrwxrwxrwx 1 root root 12 Sep 20 23:53 sar20 -> 201709/sar20 [root@b08s02ur sa]#
The way the directory structure updates is actually pretty ingenius. Previously all of the data resided in this directory. To support more than 30 days, it now creates a directory /var/log/sa/$YEAR$MONTH/. Each file is a symlink into the current month. Honestly, that is super clever.