Description of problem: For bug 475255, the max history for sar data was shortened to 26 days to prevent today's data from being appended to last month's data. From sysstat-5.0.5-history.patch: < +[ ${HISTORY} -gt 28 ] && HISTORY=28 --- > +[ ${HISTORY} -gt 26 ] && HISTORY=26 Unfortunately, 26 days is still too long. Given that 1. February only has 28 days, and 2. that 'find ... -mtime +26' finds files that were modified 27 or more days ago, and 3. find ignores fractional days and thus has rounding errors, and 4. the DST changes take place within sar's $HISTORY window (as of 2007, the second Sunday in March[1], or March 14, 2010 this year) then /usr/lib/sa/sa2 is only deleting files that are 28 days or older (not 27). As a result, sar data from March 15 to March 28 was getting appended to the data from February instead of replacing it. You can see the files from March 15 to 28 are 2x the size of normal files. # ls -al ... -rw-r--r-- 1 root root 813552 Mar 12 23:50 sa12 -rw-r--r-- 1 root root 813552 Mar 13 23:50 sa13 -rw-r--r-- 1 root root 779664 Mar 14 23:50 sa14 -rw-r--r-- 1 root root 1626864 Mar 15 23:50 sa15 -rw-r--r-- 1 root root 1626864 Mar 16 23:50 sa16 -rw-r--r-- 1 root root 1626864 Mar 17 23:50 sa17 ... -rw-r--r-- 1 root root 1626864 Mar 26 23:50 sa26 -rw-r--r-- 1 root root 1626864 Mar 27 23:50 sa27 -rw-r--r-- 1 root root 1626864 Mar 28 23:50 sa28 -rw-r--r-- 1 root root 813552 Mar 29 23:50 sa29 -rw-r--r-- 1 root root 339120 Mar 30 09:50 sa30 ... The max needs to be 25 days to account for DST now. Version-Release number of selected component (if applicable): sysstat-5.0.5-25.el4 How reproducible: every time Steps to Reproduce: 1. run sar through Febrary and March 2010 Actual results: March 15-28 data is appended to February 15-28 data Expected results: March data replaces February data Additional info:
Ooops, I forgot the referenced link [1] http://en.wikipedia.org/wiki/Energy_Policy_Act_of_2005#Change_to_daylight_saving_time
Created attachment 404072 [details] demo program for find rounding errors Attached is a demo script to show how 'find ... -mtime +26 ...' fails to find files that are 27 days old when dealing with the DST time change on March 14, 2010. It touches a series of files, sa10 to sa20, with timestamps from February 10 to February 20 at 23:53. It then sets the date to March 15 and finds files that are older than 26 days. (And finally restores the date.) # ./find26.sh Stopping ntpd: [ OK ] Stopping crond: [ OK ] Mon Mar 15 23:53:00 EDT 2010 -rw-r--r-- 1 root root 0 Feb 15 23:53 /root/timestamp/sa15 -rw-r--r-- 1 root root 0 Feb 14 23:53 /root/timestamp/sa14 -rw-r--r-- 1 root root 0 Feb 13 23:53 /root/timestamp/sa13 -rw-r--r-- 1 root root 0 Feb 12 23:53 /root/timestamp/sa12 -rw-r--r-- 1 root root 0 Feb 11 23:53 /root/timestamp/sa11 -rw-r--r-- 1 root root 0 Feb 10 23:53 /root/timestamp/sa10 Thu Apr 1 12:35:12 EDT 2010 Starting crond: [ OK ] Starting ntpd: [ OK ] You can see that youngest file it found was from February 15 which is 28 days old on March 15. It does not find sa16 which is 27 days (in our thinking) even though we specified +26. This is due to the rounding errors from find ignoring fractional parts of days.
Created attachment 404076 [details] patch for the history patch
An advisory has been issued which should help the problem described in this bug report. This report is therefore being closed with a resolution of ERRATA. For more information on therefore solution and/or where to find the updated files, please follow the link below. You may reopen this bug report if the solution does not work for you. http://rhn.redhat.com/errata/RHBA-2011-0224.html