Can I avoid debian-sa1 lines in my syslog?

My syslog is chock-full of the following:

Oct 28 23:35:01 myhost CRON[17705]: (root) CMD (command -v debian-sa1 > /dev/null && debian-sa1 1 1)
Oct 28 23:45:01 myhost CRON[18392]: (root) CMD (command -v debian-sa1 > /dev/null && debian-sa1 1 1)

and also some

Oct 28 23:59:01 myhost CRON[19251]: (root) CMD (command -v debian-sa1 > /dev/null && debian-sa1 60 2)

Now, obviously, these come from cron jobs, in /etc/cron.d/sysstat:

# Activity reports every 10 minutes everyday
5-55/10 * * * * root command -v debian-sa1 > /dev/null && debian-sa1 1 1

# Additional run at 23:59 to rotate the statistics file
59 23 * * * root command -v debian-sa1 > /dev/null && debian-sa1 60 2

Do I need to have this run so frequently? It doesn’t seem to do much when I run it manually. Can I/should I just turn off the cron job, or uninstall sysstat?

Asked By: einpoklum

||

cron usually logs to its own facility: LOG_CRON.

So just configure your syslog to avoid logging this facility unless priority is greater or equal than LOG_ERR or LOG_WARN.

Answered By: binarym

These commands are, indeed, part of the sysstat package. It’s intended for performance monitoring; and specifically, sar is the system activity report:

a Unix System V-derived system monitor command used to report on various system loads, including CPU activity, memory/paging, interrupts, device load, network and swap space utilization. Sar uses /proc filesystem for gathering information

So, running this command does not actually do anything which helps your system’s health or stability, it’s just statistics-gathering.

With this in mind, you have three options:

  1. Uninstall sysstat as @wurtel suggests. You indicate you’re not even able to see the gathered statistics, so obviously you’re not really using this facility. That means you probably don’t need such monitoring in the first place.
  2. Move cron output into a separate file from /var/log/messages, e.g. into /var/log/cron. If you’re using rsyslog for logging, which you likely are given that it’s the default on Devuan, you need to do is un-comment a line intended for just this purpose in /etc/rsyslog.conf:

    #cron.*                         /var/log/cron.log
    

    just remove the initial #; and remove cron from what goes into /var/log/syslog, i.e. replace this:

    *.=info;*.=notice;*.=warn;
        auth,authpriv.none;
        cron,daemon.none;
        mail,news.none          -/var/log/messages
    

    with this:

    *.=info;*.=notice;*.=warn;
        auth,authpriv.none;
    <h1>cron,daemon.none;</h1>
    
        daemon.none;
        mail,news.none          -/var/log/messages
    
  3. In case you don’t care to see cron job logging if there were no errors, @binarym suggests limiting the logging to error or warning messages. With rsyslog, that means replacing this:
    *.=info;*.=notice;*.=warn;
        auth,authpriv.none;
        cron,daemon.none;
        mail,news.none          -/var/log/messages
    

    with this:

    *.=info;*.=notice;*.=warn;
        auth,authpriv.none;
        daemon.none;
        mail,news.none          -/var/log/messages
    *.=warn;*.=err
        cron                    -/var/log/messages
    

    in the default /etc/rsyslogd.conf. (Although, frankly, I don’t understand why .=err isn’t there in the first place.

Answered By: einpoklum

As of Debian 11, if you use systemd, you should be able to remove the cron job file (/etc/cron.d/sysstat) after running:

dpkg-reconfigure sysstat

and select «Yes»

This will enable some systemd tasks:

  • sysstat-collect
  • sysstat-summary

which will do the same thing.

Answered By: Yvan
Categories: Answers Tags: , , , ,
Answers are sorted by their score. The answer accepted by the question owner as the best is marked with
at the top-right corner.