DreamPhysix

Well-Known Member
Sep 30, 2009
78
0
56
Received an email notification with subject "Cron <[email protected]> /usr/lib64/sa/sa2 -A" and body "Invalid system activity file: /var/log/sa//sa16" not sure how to interpret this. first time ive seen it
 

cPanelTristan

Quality Assurance Analyst
Staff member
Oct 2, 2010
7,607
40
348
somewhere over the rainbow
cPanel Access Level
Root Administrator
It appears to be related to some cron for sar that you have setup. What is the full cron you have in /var/spool/cron/root in regards to sar?
 

DreamPhysix

Well-Known Member
Sep 30, 2009
78
0
56
It appears to be related to some cron for sar that you have setup. What is the full cron you have in /var/spool/cron/root in regards to sar?
Nothing in my cron relates to sar:
0 6 * * * /usr/local/cpanel/scripts/exim_tidydb > /dev/null 2>&1
0 1 * * * /usr/local/cpanel/scripts/cpbackup
35 * * * * /usr/bin/test -x /usr/local/cpanel/bin/tail-check && /usr/local/cpanel/bin/tail-check
45 */4 * * * /usr/bin/test -x /usr/local/cpanel/scripts/update_mailman_cache && /usr/local/cpanel/scripts/update_mailman_cache
30 */4 * * * /usr/bin/test -x /usr/local/cpanel/scripts/update_db_cache && /usr/local/cpanel/scripts/update_db_cache
45 */8 * * * /usr/bin/test -x /usr/local/cpanel/bin/optimizefs && /usr/local/cpanel/bin/optimizefs
30 */2 * * * /usr/local/cpanel/bin/mysqluserstore >/dev/null 2>&1
15 */2 * * * /usr/local/cpanel/bin/dbindex >/dev/null 2>&1
15 */6 * * * /usr/local/cpanel/scripts/recoverymgmt >/dev/null 2>&1
*/5 * * * * /usr/local/cpanel/bin/dcpumon >/dev/null 2>&1
0 0 * * * /usr/local/cpanel/whostmgr/docroot/cgi/cpaddons_report.pl --notify
2,17,32,47 * * * * /usr/local/cpanel/whostmgr/bin/dnsqueue > /dev/null 2>&1
2,58 * * * * /usr/local/bandmin/bandmin
0 0 * * * /usr/local/bandmin/ipaddrmap
0 0 * * * /usr/local/cpanel/scripts/upcp --cron
@weekly for i in `find /home/*/public_html -type f -name error_log` ;do >$i ;done
0 1 * * * cd /root/ && sh backup.sh
 

cPanelTristan

Quality Assurance Analyst
Staff member
Oct 2, 2010
7,607
40
348
somewhere over the rainbow
cPanel Access Level
Root Administrator
I think the cron is stemming from this location:

/etc/cron.d/sysstat

Please post the contents of sysstat:

Code:
cat /etc/cron.d/sysstat
Next, does /var/log/sa exist? If so, please post the contents of /var/log/sa files:

Code:
ls -lah /var/log/sa
 

DreamPhysix

Well-Known Member
Sep 30, 2009
78
0
56
I think the cron is stemming from this location:

/etc/cron.d/sysstat

Please post the contents of sysstat:

Code:
cat /etc/cron.d/sysstat
Next, does /var/log/sa exist? If so, please post the contents of /var/log/sa files:

Code:
ls -lah /var/log/sa
# Run system activity accounting tool every 10 minutes
*/10 * * * * root /usr/lib64/sa/sa1 -S DISK 1 1
# 0 * * * * root /usr/lib64/sa/sa1 -S DISK 600 6 &
# Generate a daily summary of process accounting at 23:53
53 23 * * * root /usr/lib64/sa/sa2 -A
total 3.6M
drwxr-xr-x 2 root root 4.0K Aug 17 00:00 .
drwxr-xr-x 5 root root 4.0K Aug 17 20:24 ..
-rw-r--r-- 1 root root 380K Aug 17 20:30 sa17
-rw-r--r-- 1 root root 462K Aug 9 23:53 sar09
-rw-r--r-- 1 root root 460K Aug 10 23:53 sar10
-rw-r--r-- 1 root root 461K Aug 11 23:53 sar11
-rw-r--r-- 1 root root 460K Aug 12 23:53 sar12
-rw-r--r-- 1 root root 463K Aug 13 23:53 sar13
-rw-r--r-- 1 root root 461K Aug 14 23:53 sar14
-rw-r--r-- 1 root root 461K Aug 15 23:53 sar15
-rw-r--r-- 1 root root 0 Aug 16 23:53 sar16
The contents of the sar files are too long to post here.. I read something the other day that told me to remove the sar files
 
Last edited:

cPanelTristan

Quality Assurance Analyst
Staff member
Oct 2, 2010
7,607
40
348
somewhere over the rainbow
cPanel Access Level
Root Administrator
Removing the /var/log/sa/sa files is what is causing this issue. You removed the binaries and now they can't be found. Here are the files in /var/log/sa on my machine:

Code:
[email protected] [/var/log/sa]# ls -lah
total 3.9M
drwxr-xr-x 2 root root 4.0K Aug 17 00:00 ./
drwxr-xr-x 9 root root 4.0K Aug 17 17:50 ../
-rw-r--r-- 1 root root 210K Aug  9 23:50 sa09
-rw-r--r-- 1 root root 210K Aug 10 23:50 sa10
-rw-r--r-- 1 root root 210K Aug 11 23:50 sa11
-rw-r--r-- 1 root root 210K Aug 12 23:50 sa12
-rw-r--r-- 1 root root 210K Aug 13 23:50 sa13
-rw-r--r-- 1 root root 210K Aug 14 23:50 sa14
-rw-r--r-- 1 root root 210K Aug 15 23:50 sa15
-rw-r--r-- 1 root root 210K Aug 16 23:50 sa16
-rw-r--r-- 1 root root 158K Aug 17 17:50 sa17
-rw-r--r-- 1 root root 227K Aug  8 23:53 sar08
-rw-r--r-- 1 root root 227K Aug  9 23:53 sar09
-rw-r--r-- 1 root root 227K Aug 10 23:53 sar10
-rw-r--r-- 1 root root 227K Aug 11 23:53 sar11
-rw-r--r-- 1 root root 227K Aug 12 23:53 sar12
-rw-r--r-- 1 root root 227K Aug 13 23:53 sar13
-rw-r--r-- 1 root root 227K Aug 14 23:53 sar14
-rw-r--r-- 1 root root 227K Aug 15 23:53 sar15
-rw-r--r-- 1 root root 227K Aug 16 23:53 sar16
I cannot determine why anything would tell someone to remove the sa* files in /var/log/sa, since that contains valuable information that tells you server cpu, idle, and so on for the past 24 hours. I also don't know how you'd get them back, since the files removed were binary files. You might have to reinstall sar itself, but that's an OS level option.

Of note, I would not suggest removing contents on any system per any guide or troubleshooting recommendations. Moving the contents to /root/backup or /root/sar would have been a better idea. At that point, you'd be able to restore those files.

If you don't want to correct sar working, which now means you won't have the useful information it provides when your server crashes or hangs, you can simply get rid of that cron:

Code:
cd /etc/cron.d
mv sysstat /root/sysstat
The cron would quit running then.
 

DreamPhysix

Well-Known Member
Sep 30, 2009
78
0
56
I don't remember the actual command I issued and it's not in /root/.bash_history. My sar command still seems to be functioning, so if the cron error disappears (i've only seen it once which was 21 hours ago) then it should work, I hope.
 

DreamPhysix

Well-Known Member
Sep 30, 2009
78
0
56
Removing the /var/log/sa/sa files is what is causing this issue. You removed the binaries and now they can't be found. Here are the files in /var/log/sa on my machine:

Code:
[email protected] [/var/log/sa]# ls -lah
total 3.9M
drwxr-xr-x 2 root root 4.0K Aug 17 00:00 ./
drwxr-xr-x 9 root root 4.0K Aug 17 17:50 ../
-rw-r--r-- 1 root root 210K Aug  9 23:50 sa09
-rw-r--r-- 1 root root 210K Aug 10 23:50 sa10
-rw-r--r-- 1 root root 210K Aug 11 23:50 sa11
-rw-r--r-- 1 root root 210K Aug 12 23:50 sa12
-rw-r--r-- 1 root root 210K Aug 13 23:50 sa13
-rw-r--r-- 1 root root 210K Aug 14 23:50 sa14
-rw-r--r-- 1 root root 210K Aug 15 23:50 sa15
-rw-r--r-- 1 root root 210K Aug 16 23:50 sa16
-rw-r--r-- 1 root root 158K Aug 17 17:50 sa17
-rw-r--r-- 1 root root 227K Aug  8 23:53 sar08
-rw-r--r-- 1 root root 227K Aug  9 23:53 sar09
-rw-r--r-- 1 root root 227K Aug 10 23:53 sar10
-rw-r--r-- 1 root root 227K Aug 11 23:53 sar11
-rw-r--r-- 1 root root 227K Aug 12 23:53 sar12
-rw-r--r-- 1 root root 227K Aug 13 23:53 sar13
-rw-r--r-- 1 root root 227K Aug 14 23:53 sar14
-rw-r--r-- 1 root root 227K Aug 15 23:53 sar15
-rw-r--r-- 1 root root 227K Aug 16 23:53 sar16
I cannot determine why anything would tell someone to remove the sa* files in /var/log/sa, since that contains valuable information that tells you server cpu, idle, and so on for the past 24 hours. I also don't know how you'd get them back, since the files removed were binary files. You might have to reinstall sar itself, but that's an OS level option.

Of note, I would not suggest removing contents on any system per any guide or troubleshooting recommendations. Moving the contents to /root/backup or /root/sar would have been a better idea. At that point, you'd be able to restore those files.

If you don't want to correct sar working, which now means you won't have the useful information it provides when your server crashes or hangs, you can simply get rid of that cron:

Code:
cd /etc/cron.d
mv sysstat /root/sysstat
The cron would quit running then.
The guide I followed is located here: SYSSTAT