Enable sysstat (sar) on Ubuntu, Debian and RHEL So You Have History Next Time

2026-10-12

Most incidents are discovered after they are over. If the server was not recording its own history, all you have is what you remember. sysstat fixes that: it samples CPU, memory, load, disk and network every few minutes and keeps days of history for sar to read.

Install

Debian and Ubuntu:

sudo apt update && sudo apt install -y sysstat

RHEL, Rocky, AlmaLinux and Fedora:

sudo dnf install -y sysstat

Turn collection on

On RHEL-like systems the service is enabled this way:

sudo systemctl enable --now sysstat

On Debian and Ubuntu the package installs the collector but leaves it disabled. Edit /etc/default/sysstat and set:

ENABLED="true"

then:

sudo systemctl enable --now sysstat

Check that it is writing data

Data files are named by day of the month. On Debian/Ubuntu they are in /var/log/sysstat/, on RHEL-like systems in /var/log/sa/:

ls -l /var/log/sysstat/ /var/log/sa/ 2>/dev/null

The first sample appears after the first collection interval (10 minutes by default, driven by a systemd timer or cron). Do not expect history before you enabled it.

Read the history

sar -u            # CPU, today
sar -r            # memory, today
sar -q            # load average and run queue
sar -d -p         # disk activity per device
sar -n DEV        # network per interface
sar -u -f /var/log/sysstat/sa10     # CPU on day 10 of the month
sar -u -s 02:00:00 -e 04:00:00      # a time window today

On RHEL-like systems replace /var/log/sysstat/ with /var/log/sa/. The -f form is how you look at yesterday or last week.

Keep more days

The retention is set by HISTORY in /etc/sysstat/sysstat (Debian/Ubuntu) or /etc/sysconfig/sysstat (RHEL-like). Raise it to keep a month:

HISTORY=28

The default differs between distributions, so check the value instead of assuming. Each day is small, usually well under a few megabytes.

Sample more often

For short spikes, 10 minutes is coarse. On systemd systems you can override the timer:

sudo systemctl edit sysstat-collect.timer

and set OnCalendar=*:*:00 for every minute. More samples mean bigger files, so keep it for the machines that need it.

FAQ

Does sysstat slow the server down? The collector runs for a fraction of a second per sample and writes a small file. On a normal server the cost is not measurable.

Can I see why a process died? sar shows the memory and swap picture around the time; for the kill itself look in dmesg or journalctl -k for "Out of memory".

Is there a graphical way to see this? sadf can export the same data as CSV or JSON for your own charts.

Shortcut

Disclosure: we make Harbor. Harbor is an SSH terminal for Mac that uses your own ssh and ~/.ssh/config, keeps jump hosts apart as gateways, shows live server stats and, with Pro, a post-mortem that reads the server's own history. The terminal, stats and a read-only database client are free. See Harbor.