Knowledgebase

Symptoms

When attempting to run sar to check the sysstat logs, you encounter a message similar to the following:

[root@server ~]cPssar -q
Invalid system activity file: /var/log/sa/sa31
File created by sar/sadc from sysstat version 10.1.5
Current sysstat version cannot read the format of this file (0x2171)

Cause

When the sysstat package gets updated, the log format may change. This will prevent sar from parsing the old log files and can prevent the files from being updated.

Resolution

1. Log in to the server via SSH or WHM's Terminal as the root user

2. Move aside the current log directory:

   mv -v /var/log/sa{,.oldformat}

3. Re-create the log directory:

   mkdir -v /var/log/sa

4. Enable the sysstat service:

   systemctl enable --now sysstat

5. Restart the sysstat service:

   systemctl restart sysstat

6. Restart the sysstat-collect service:

   systemctl restart sysstat-collect

7. Convert the old log files to the current format:

   find /var/log/sa.oldformat/ -type f | while read salog ; do sadf -c $salog > $salog.converted ; done