Update sa reports every 6 hours

Question

On SuSE Linux the default cron-job for sa/sar looks like this:

# /etc/cron.d/sysstat
# Activity reports every 10 minutes everyday
*/10 * * * * root [ -x /usr/lib64/sa/sa1 ] && exec /usr/lib64/sa/sa1 -S ALL 1 1

# Update reports every 6 hours
55 5,11,17,23 * * *     root [ -x /usr/lib64/sa/sa2 ] && exec /usr/lib64/sa/sa2 -A

I use the tool ksar to look at the data. But the data is missing the last hours because the report gets updated only every 6 hours.

Is there a reason why the reports get updated only every 6 hours?

Why not every 10 minutes?

Or is this default just not a sane default?

Answer 1

sa1 - Collect and store binary data in the system activity daily data file.

sa2 - Write a daily report in the /var/log/sa directory.

So your sa2 cron says we are writing daily report every 6 hrs, which is may be or may not be required. Writing every 10min daily report may be unnecessary? Remember you already have sa1 which is collecting things every 10 min already everyday.

Edit: to answer comment.

THE FIRST SYSSTAT CRON JOB: /usr/lib64/sa/sa1 It runs every 10 min and collects sar data for historical reference. This writes the data to /var/log/sa/saXX file. XX is the day of the month. sa1 creates binary files so we can’t open them via a text editor. It accepts two parameters to sa1: interval (in seconds) and counts. In the above crontab example: sa1 1 1 means that sa1 will collect data once with an interval of 1 second every ten mins.

THE SECOND SYSSTAT CRON JOB: /usr/lib64/sa/sa2 It runs ever 6hrs to create the daily summary report of sar data. sa2 creates /var/log/sa/sarXX file. It creates ASCII text files and therefore can be opened with a text editor or displayed to stdout. This file contains summary information on all metrics whose statistics are captured by sar. Sysstat saves the files generated by sa1 and sa2 for 28 days by default, but this can be changed by modifying the HISTORY variable in the /etc/sysconfig/sysstat file.