Historical performance data with sysstat: enabling collection and reading past days with sar -f

Goal

Turn on sysstat's background data collection so a "what happened yesterday at 3pm" question can be answered after the fact, then read that data back with sar -f.

Prerequisites

Root; the sysstat package (DEBIAN_FRONTEND=noninteractive apt-get install -y sysstat or dnf install -y sysstat); a service manager able to enable a systemd timer or cron job.

Steps

1. Confirm the collector: sadc's manual describes it as the tool invoked periodically to append a sample to the day's data file.
2. On Debian and Ubuntu, set ENABLED="true" in /etc/default/sysstat (the collection script checks it and otherwise records nothing), then systemctl enable --now sysstat. On RHEL 8/9 and current Fedora, systemctl enable --now sysstat activates the sysstat-collect.timer and sysstat-summary.timer units that run sa1/sa2; older releases such as RHEL 7 use /etc/cron.d/sysstat instead. Verify with systemctl list-timers 'sysstat*' or by reading /etc/cron.d/sysstat rather than assuming either mechanism.
3. sadc's manual states that, by default, the standard system activity daily data file is located in the /var/log/sysstat directory; this is the Debian/Ubuntu default, RPM-based systems commonly use /var/log/sa, so check the installed package's actual configuration rather than assuming a path.
4. Wait through at least one collection interval (commonly every 10 minutes), or trigger one manually: sudo /usr/lib/sysstat/sa1 1 1 on Debian/Ubuntu, sudo /usr/lib64/sa/sa1 1 1 on RHEL-family systems.
5. Read a specific day back: sar -f /var/log/sysstat/sa15 (adjust the path and day number). sar's manual describes -f as extracting and writing records previously saved in a file, defaulting to the standard system activity daily data file when no filename is given.
6. Narrow to a time window and a section: sar -f /var/log/sysstat/sa15 -s 14:00:00 -e 15:00:00 -u for CPU, or -n DEV / -n TCP,ETCP for the network sections used in a live first look.

Expected result

A named day's file that sar -f can replay for any past interval the retention window still holds, without the incident needing to still be happening.

Limits and test basis

Retention is set by HISTORY in /etc/sysstat/sysstat (Debian/Ubuntu, 7 days by default) or /etc/sysconfig/sysstat (RHEL-family, 28 by default); check it before relying on data from last month. The files are binary and tied to the sysstat file-format version, so a sar of a different version may refuse a copied file. When replaying a file, sar shows timestamps in the reader's local time; -t shows the original local time of the host that wrote it. Enabling collection adds a small, continuous overhead and disk use; to undo, disable the service or cron entry (systemctl disable --now sysstat, plus ENABLED="false" on Debian/Ubuntu) and remove the data directory if the history is no longer wanted. No reboot is required either way.