Stop /var/log Filling With sa Files in RHEL

If your RHEL system’s /var/log directory is filling up with sa files (like sa01, sa02, etc.), the cause is the System Activity Reporter (sar) from the sysstat package, which by default keeps 28 days of daily system activity logs. To stop this, you can either disable the sysstat collection service or reduce the number of days it retains data by editing the HISTORY variable in /etc/sysconfig/sysstat and restarting the service.

Formula

The estimated disk space used by sa files is roughly:

Size (MB) ≈ Days × 1.5 MB

Where:

• Days = number of days of history you keep (the HISTORY value)
• 1.5 MB = approximate average size of a single sa file on a typical RHEL server (actual size varies with system activity and number of CPUs)

Worked Example

Using the default values from the calculator above:

1. Enter 7 days to keep.
2. Estimated size = 7 × 1.5 = 10.5 MB.

So setting HISTORY=7 will keep about 10.5 MB of sa files, instead of the default 28 days which would use roughly 42 MB.

What Are sa Files and Why Do They Accumulate?

sa files are binary data files created by the sadc (System Activity Data Collector) command, part of the sysstat package. On RHEL, a cron job runs sadc every 10 minutes and writes the collected CPU, memory, I/O, and network statistics to a daily file named saDD (where DD is the day of the month) in /var/log/sa. These files are the raw data that the sar command reads to display historical performance reports.

By default, RHEL’s sysstat configuration keeps 28 days of these files. After 28 days, the oldest is deleted automatically. However, if you have a busy system, each file can grow to several megabytes, and 28 of them can consume a significant chunk of /var/log. Also, if the cron job runs more frequently than every 10 minutes (some admins change it), the files grow faster.

How to Check Current Disk Usage

Before changing anything, see how much space the sa files are using:

1. Run du -sh /var/log/sa to see total size.
2. Run ls -lh /var/log/sa to list individual files and their sizes.
3. Check the current HISTORY value with grep HISTORY /etc/sysconfig/sysstat.

If the directory is over a few hundred megabytes, you have a valid reason to reduce retention.

How to Reduce the Number of sa Files

The cleanest way is to edit the HISTORY variable:

1. Open /etc/sysconfig/sysstat with a text editor (e.g., vi or nano).
2. Change HISTORY=28 to a lower number, like 7 or 14.
3. Save the file.
4. Restart the sysstat service so the change takes effect: systemctl restart sysstat (or service sysstat restart on older RHEL).

This does not delete existing files immediately. To clean up old files right away, manually remove them: rm /var/log/sa/sa$(date +%d -d '8 days ago') – repeat for each day you want to delete, or use a loop. Be careful not to delete today’s file (the one named saDD where DD is today’s date).

How to Disable sa File Collection Entirely

If you never use sar reports, you can stop the collection altogether:

1. Stop the service: systemctl stop sysstat
2. Disable it from starting at boot: systemctl disable sysstat
3. Optionally, remove the cron job that runs sadc. The cron file is usually /etc/cron.d/sysstat. Comment out or delete the lines that call sadc.

After this, no new sa files will be created. You can then delete the existing directory contents: rm /var/log/sa/sa* (but if you plan to re-enable later, keep the directory itself).

Common Misconceptions and Pitfalls

• Misconception: “sa files are logs I need for security.â€� They are performance metrics, not security logs. If you need historical performance data, keep a few days; if not, disable them.
• Pitfall: Deleting today’s file. The sa file for the current day is being written to; deleting it will cause errors until the next collection cycle.
• Pitfall: Editing /etc/sysconfig/sysstat but not restarting. The change won’t take effect until the service restarts.
• Misconception: “Reducing HISTORY also reduces memory usage.â€� It only affects disk usage. The sadc process still collects data in memory each interval.

Alternatives to Reduce Disk Pressure

If you want to keep more history but have limited disk space, consider:

• Move the sa directory to a larger partition by editing SA_DIR in /etc/sysconfig/sysstat (e.g., to /var/log/sa on a separate mount).
• Compress old files manually with gzip – but note that sar cannot read compressed files directly; you’d need to decompress them first.
• Use a logrotate rule for /var/log/sa to rotate and compress, though this is not standard on RHEL.

Frequently Asked Questions

Can I just delete all sa files?

Yes, but only after stopping the sysstat service, otherwise the next collection cycle will recreate them. If you delete them while the service is running, the current day’s file will be recreated within 10 minutes.

What is the difference between sa and sar files?

sa files are binary data files; sar is the command that reads them. There are also text reports (like sar01) if you have the sysstat cron job set to generate them, but by default RHEL only creates the binary sa files.

Will reducing HISTORY affect my ability to troubleshoot past performance?

Yes, you will lose data older than the new HISTORY value. If you need long-term performance trends, consider moving the directory to a larger disk instead of reducing retention.

Why are my sa files larger than 1.5 MB each?

The size depends on the number of CPUs, disk I/O, network interfaces, and the interval. A busy system with many CPUs can produce files several times larger. Use du -h /var/log/sa/sa* to see actual sizes.

Do I need to restart the cron service after changing sysstat config?

No, the cron job reads the config file each time it runs. But you should restart the sysstat service so the HISTORY variable is picked up for the daily rotation.

Related

• Microsoft Copilot Agents: What They Actually Do
• Convert Live Photo Popular Formats Explained
• Steal an Egg Eternal Oni Tiger Bloom Mutation?

in t | Days to keep | days | 7 | 0 | 3650
out size | Estimated sa files size | MB | (t * 1.5) | 1