Invalid system activity (sysstat) file on Ubuntu server

Question

I'm periodically getting this message from the daily cron on my server. (I don't get this message every day.)

/etc/cron.daily/sysstat:
Invalid system activity file: /var/log/sysstat//sa28

Here's some basic info on my server:

Ubuntu 12.04.2 LTS
Linux server 3.8.4-x86_64-linode31 #1 SMP Mon Mar 25 16:00:34 EDT 2013 x86_64 x86_64 x86_64 GNU/Linux

Here is the relevant directory listing:

/var/log/sysstat$ ls -lai
total 44
6601 drwxr-xr-x  2 root root 4096 Apr 29 06:48 .
6550 drwxr-xr-x 13 root root 4096 Apr 29 06:48 ..
  16 -rw-r--r--  1 root root  384 Apr 22 00:00 sa21
 510 -rw-r--r--  1 root root  384 Apr 23 00:00 sa22
 524 -rw-r--r--  1 root root  384 Apr 24 00:00 sa23
2613 -rw-r--r--  1 root root  384 Apr 25 00:00 sa24
2199 -rw-r--r--  1 root root  384 Apr 26 00:00 sa25
2745 -rw-r--r--  1 root root  384 Apr 27 00:00 sa26
2577 -rw-r--r--  1 root root  384 Apr 28 00:00 sa27
  22 -rw-r--r--  1 root root  384 Apr 29 00:00 sa28
1221 -rw-r--r--  1 root root  336 Apr 29 21:45 sa29
2765 -rw-r--r--  1 root root    0 Apr 22 06:55 sar21
2744 -rw-r--r--  1 root root    0 Apr 23 06:39 sar22
2003 -rw-r--r--  1 root root    0 Apr 24 06:27 sar23
1974 -rw-r--r--  1 root root    0 Apr 25 06:36 sar24
1600 -rw-r--r--  1 root root    0 Apr 26 06:25 sar25
2753 -rw-r--r--  1 root root    0 Apr 27 06:54 sar26
 423 -rw-r--r--  1 root root    0 Apr 28 06:54 sar27
 526 -rw-r--r--  1 root root    0 Apr 29 06:48 sar28

I have no idea what the problem is and I don't even understand why I'm seeing two copies of each file name. (I see they are different inodes but it is still confusing.)

My first step was to read this: http://linux.die.net/man/1/sar

I appreciate any suggestions.

score 7 · Accepted Answer · answered Apr 29 '13 at 22:13

7

You are trying to use a file which is not a system activity file, or whose format is no longer compatible with that of files created by current version of sar

Just remove the files:

rm /var/log/sa/sa??

answered Apr 29 '13 at 22:13

Danila Ladner

5,241
21
30

Thanks. Just to be safe, I did this: `/var/log/sysstat# mkdir /root/sysstat_copy` and `mv * /root/sysstat_copy/` – MountainX Apr 29 '13 at 22:21
any idea why `ls` showed two of each file name in `/var/log/sysstat`? – MountainX Apr 29 '13 at 22:22
sa and sar are different files. Sa files are data files, sar files are reports. – Danila Ladner Apr 29 '13 at 22:29
"sa and sar are different files": oh, I missed that! And maybe I moved the wrong files by mistake too... – MountainX Apr 30 '13 at 02:20
I had ASCII text when checked `file /var/log/sa/sar20160304` So I removed the files and restarted service. `sudo systemctl restart sysstat-collect.service` – michalzuber Mar 12 '16 at 17:25

score 5 · Answer 2 · answered Dec 23 '14 at 09:47

I have found that this happens when adding/removing (v)CPUs. Doing that probably adds/removes columns in the data file format or something.

Removing the "invalid" saXX files and simply running sar caused it to regenerate and start collecting data again.

score 3 · Answer 3 · answered Jun 23 '16 at 07:05

I have found this issue when I change my instance type in EC2 to higher one which modified the CPU too. So, because of this there is a issue with sar.

Inside /var/log/sysstat/ there are two types of file named with saXX stores data. So you just move those saXX files to some folder and then run

sudo service sysstat restart

It will fix it :)

Invalid system activity (sysstat) file on Ubuntu server

3 Answers3