9

My syslog is chock-full of the following:

Oct 28 23:35:01 myhost CRON[17705]: (root) CMD (command -v debian-sa1 > /dev/null && debian-sa1 1 1)
Oct 28 23:45:01 myhost CRON[18392]: (root) CMD (command -v debian-sa1 > /dev/null && debian-sa1 1 1)

and also some

Oct 28 23:59:01 myhost CRON[19251]: (root) CMD (command -v debian-sa1 > /dev/null && debian-sa1 60 2)

Now, obviously, these come from cron jobs, in /etc/cron.d/sysstat:

# Activity reports every 10 minutes everyday
5-55/10 * * * * root command -v debian-sa1 > /dev/null && debian-sa1 1 1

# Additional run at 23:59 to rotate the statistics file
59 23 * * * root command -v debian-sa1 > /dev/null && debian-sa1 60 2

Do I need to have this run so frequently? It doesn't seem to do much when I run it manually. Can I/should I just turn off the cron job, or uninstall sysstat?

einpoklum
  • 8,772
  • 19
  • 65
  • 129
  • 1
    If you don't use the data that sysstat is logging, then feel free to turn it off or to just remove the package (assuming there's nothing that depends on it). Alternatively configure your syslog daemon to log cron messages to a separate log file, and stop logging those to the syslog file. – wurtel Oct 29 '19 at 10:02

3 Answers3

6

These commands are, indeed, part of the sysstat package. It's intended for performance monitoring; and specifically, sar is the system activity report:

a Unix System V-derived system monitor command used to report on various system loads, including CPU activity, memory/paging, interrupts, device load, network and swap space utilization. Sar uses /proc filesystem for gathering information

So, running this command does not actually do anything which helps your system's health or stability, it's just statistics-gathering.

With this in mind, you have three options:

  1. Uninstall sysstat as @wurtel suggests. You indicate you're not even able to see the gathered statistics, so obviously you're not really using this facility. That means you probably don't need such monitoring in the first place.

  2. Move cron output into a separate file from /var/log/messages, e.g. into /var/log/cron. If you're using rsyslog for logging, which you likely are given that it's the default on Devuan, you need to do is un-comment a line intended for just this purpose in /etc/rsyslog.conf:

    #cron.*                         /var/log/cron.log

    just remove the initial #; and remove cron from what goes into /var/log/syslog, i.e. replace this:

    *.=info;*.=notice;*.=warn;\
    auth,authpriv.none;\
    cron,daemon.none;\
    mail,news.none          -/var/log/messages

    with this:

    *.=info;*.=notice;*.=warn;\
    auth,authpriv.none;\
<h1>cron,daemon.none;\</h1>

    daemon.none;\
    mail,news.none          -/var/log/messages
  3. In case you don't care to see cron job logging if there were no errors, @binarym suggests limiting the logging to error or warning messages. With rsyslog, that means replacing this: 
    *.=info;*.=notice;*.=warn;\
    auth,authpriv.none;\
    cron,daemon.none;\
    mail,news.none          -/var/log/messages
    with this: 
    *.=info;*.=notice;*.=warn;\
    auth,authpriv.none;\
    daemon.none;\
    mail,news.none          -/var/log/messages
*.=warn;*.=err\
    cron                    -/var/log/messages
    in the default /etc/rsyslogd.conf. (Although, frankly, I don't understand why .=err isn't there in the first place.
einpoklum
  • 8,772
  • 19
  • 65
  • 129
0

cron usually logs to its own facility: LOG_CRON.

So just configure your syslog to avoid logging this facility unless priority is greater or equal than LOG_ERR or LOG_WARN.

binarym
  • 2,639
  • 9
  • 12
0

As of Debian 11, if you use systemd, you should be able to remove the cron job file (/etc/cron.d/sysstat) after running:

dpkg-reconfigure sysstat

and select «Yes»

This will enable some systemd tasks:

  • sysstat-collect
  • sysstat-summary

which will do the same thing.

Yvan
  • 241
  • 2
  • 5