Frequent creation of "sa" files in /var/log/sa can quickly consume disk space on RHEL 8 servers, especially when sysstat's data collection is left at its default settings. These files are generated by the sysstat package, which includes tools like sar for monitoring system performance. When left unmanaged, accumulated "sa" files may lead to disk space shortages and impact system stability.

Disable sysstat Data Collection

Step 1: Stop the sysstat service to immediately halt new log generation. This can be done using the following command:

systemctl stop sysstat

This prevents sa files from being created until the service is restarted.

Step 2: To permanently disable sysstat and prevent it from starting at boot, run:

systemctl disable sysstat

This change ensures that sysstat does not resume logging after a system reboot, stopping further growth of /var/log/sa.

Adjust sysstat Log Retention Period

Step 1: Open the sysstat configuration file with your preferred text editor. For example:

vi /etc/sysconfig/sysstat

Step 2: Locate the line starting with HISTORY=. This value controls how many days of data are kept. To reduce disk usage, set this to a lower number, such as 7:

HISTORY=7

This limits the number of sa files retained, automatically removing older logs.

Step 3: Save the file and restart sysstat to apply changes:

systemctl restart sysstat

Reducing retention minimizes disk consumption while still allowing recent performance data collection.

Manually Remove Old "sa" Files

Step 1: List existing sa files in /var/log/sa:

ls /var/log/sa/sa*

Step 2: Delete files older than a certain number of days (e.g., 7 days) using the find command:

find /var/log/sa/ -name "sa*" -type f -mtime +7 -delete

This command safely removes only those files older than 7 days, freeing up disk space without affecting recent logs.

Step 3: Consider automating this cleanup by adding the command to your system's crontab for regular execution.

Alternative: Uninstall sysstat Package

Step 1: If you do not require system activity reporting, you can remove sysstat entirely:

dnf remove sysstat

This eliminates all sysstat-related logging and monitoring, so only use this approach if you are certain these tools are not needed for your system administration or troubleshooting.

Managing sysstat's logging behavior ensures that /var/log/sa does not overfill your disk. Regularly review your retention settings or disable sysstat if ongoing monitoring is unnecessary.