Skip to main content

Historical Performance Stats

When performance problems are intermittent, "what is happening right now" is not enough. You need a timeline. This page shows how to collect and read historical stats on a Linux server without deploying a full monitoring platform.

Quick Summary
  • Enable sysstat to collect CPU, memory, and disk activity history.
  • Use sar to replay past incidents.
  • Combine with journalctl to correlate service restarts and errors.

Enable sysstat collection​

Install sysstat (package name is usually the same across distros), then ensure collection is enabled.

install-sysstat.sh
sudo apt update
sudo apt install -y sysstat

On many systems, a systemd timer is used:

enable-sysstat-timer.sh
systemctl list-timers --all | rg -n 'sysstat|sa'
sudo systemctl enable --now sysstat-collect.timer || true
sudo systemctl enable --now sysstat-summary.timer || true

If your distro uses cron instead, check /etc/cron.d/sysstat.

Replay CPU usage​

sar-cpu.sh
sar -u
sar -u -s 10:00:00 -e 11:00:00

Replay memory and swap activity​

sar-memory.sh
sar -r
sar -S

What to watch:

  • Rising swap used with sustained swap-in/swap-out indicates memory pressure.
  • Large page cache is normal; sustained reclaim pressure is not.

Replay disk and I/O wait​

sar-io.sh
sar -b
sar -d

If iostat is installed, you can also use it live during an incident.

Correlate with service logs​

Use journalctl to see whether services restarted, crashed, or logged errors during the window.

journalctl-correlation.sh
journalctl --since '2026-03-01 10:00:00' --until '2026-03-01 11:00:00' --no-pager | rg -n 'oom|killed process|panic|error|fail'

journalctl -u mysql --since '1 hour ago' --no-pager | tail -n 200

Keep the data useful​

  • Ensure the server clock is correct (timedatectl).
  • Keep enough retention to cover your incident investigation window.
  • Avoid filling the disk with metrics data (monitor disk usage).

Next steps​

  • For live pressure debugging: see [Monitoring health](./monitoring-health).
  • For disk-heavy incidents: see [Disk I/O troubleshooting](./disk-io-troubleshooting).