August 20, 2012, 10:13 AM — Most admins monitoring system performace with sar (sysstat) collect performance data over the span of a week or two, but you can easily extend this to four weeks. In fact, you can extend the coverage period to well beyond a month if you need to maintain a longer view of performance and if you have enough disk space to hold all the data. Today's post details how to configure the coverage period and provides a script that will provide daily averages for as many days' of /var/log/sa## files you retain.
To change the number of days that sar will maintain data files, go to the /etc/sysconfig directory and edit the sysstat file. Change HISTORY=7 to HISTORY=28. If you change that number to anything greater than 28, you will end up with your sa## files separated into folders by month.
# How long to keep log files (days), maximum is a month HISTORY=7
If you keep more than 28 days of performance data, sar will create a directory for each month. If just started collecting data with HISTORY set to greater than 28, you would see something like this.
drwxr-xr-x. 2 root root 4096 Aug 19 19:11 201208 lrwxrwxrwx. 1 root root 11 Aug 19 19:11 sa19 -> 201208/sa19
Notice that a directory has been set up for August 2012 in year/month format. A symbolic link associates the current collection (August 19th) to the data file in the 201208 directory. So /var/log/sa/sa19 is still a valid reference.
If you intend to hold performance data on line for a long period of time, take the size of one day's or one week's collection and multiply by the number of days or weeks to get the overall size. The data files should all be the same size unless your weekend collections are more sparse.
Today's script below is similar to one that I presented a couple weeks ago, but it will run against any number of /var/log/sa/sa## files. Plus, it doesn't care about the day of the week.