The entries you're seeing in your Logwatch reports (/usr/lib64/sa/sa1 and /usr/lib64/sa/sa2) are part of the sysstat package, a system performance monitoring tool for Linux. The sa1 command collects system activity data, while sa2 generates daily reports.

Since you didn't find these entries in your user crontab (crontab -e), check these system locations instead:

# Check system-wide cron jobs
ls /etc/cron.d/
cat /etc/cron.d/sysstat

# Or check hourly cron jobs
ls /etc/cron.hourly/
cat /etc/cron.hourly/sysstat

Here's what a standard sysstat cron configuration might look like:

# Example /etc/cron.d/sysstat content
# Activity reports every 10 minutes
*/10 * * * * root /usr/lib64/sa/sa1 1 1
# Daily summary at 23:53
53 23 * * * root /usr/lib64/sa/sa2 -A

To modify how often data is collected:

# Edit the sysstat cron file
sudo nano /etc/cron.d/sysstat

# Change the first line to collect every 5 minutes instead of 10
*/5 * * * * root /usr/lib64/sa/sa1 1 1

To access the collected performance data:

# View today's data
sar -f /var/log/sa/sa$(date +%d)

# View CPU usage
sar -u

# View memory usage
sar -r

# View disk I/O
sar -b

If you want to stop the data collection completely:

# Stop the service
sudo systemctl stop sysstat

# Disable at boot
sudo systemctl disable sysstat

# Remove or rename the cron file
sudo mv /etc/cron.d/sysstat /etc/cron.d/sysstat.bak

If you're seeing an unusually high number of executions (like the 4297 times in your report):

1. Check for duplicate cron entries
2. Verify the cron schedule format
3. Look for manual executions in shell history

# Check for duplicate cron entries
grep -r "sa1" /etc/cron*

# Check shell history for root
sudo cat /root/.bash_history | grep sa1

The /usr/lib/sa/sa1 and /usr/lib/sa/sa2 scripts are part of the sysstat package, which collects system performance data. The sa1 command collects binary data in /var/log/sa/, while sa2 generates human-readable reports.

These jobs typically run from system crontabs rather than user crontabs. Check these locations:

# System-wide crontab
cat /etc/crontab

# Sysstat package crontab (common location)
cat /etc/cron.d/sysstat

# Alternative locations
ls -la /etc/cron.*/sysstat

A typical /etc/cron.d/sysstat file contains:

# Run system activity accounting tool every 10 minutes
*/10 * * * * root /usr/lib64/sa/sa1 1 1
# Generate a daily summary of process accounting at 23:53
53 23 * * * root /usr/lib64/sa/sa2 -A

Your Logwatch shows:

• sa1 ran 4297 times (collecting data every 10 minutes)
• sa2 ran 29 times (daily reports)
• Cron ran hourly jobs 716 times

To modify collection frequency:

# Edit the sysstat cron file
sudo nano /etc/cron.d/sysstat

# Change the interval to 5 minutes
*/5 * * * * root /usr/lib64/sa/sa1 1 1

Verify your sysstat configuration:

# Check if sysstat is enabled
sudo systemctl status sysstat

# View current collection interval
cat /etc/sysconfig/sysstat | grep HISTORY

If you want to stop data collection:

# Disable the service
sudo systemctl stop sysstat
sudo systemctl disable sysstat

# Or remove the package
sudo yum remove sysstat   # RHEL/CentOS
sudo apt remove sysstat   # Debian/Ubuntu

To view collected statistics:

# CPU usage
sar -u

# Memory usage
sar -r

# Disk I/O
sar -b

# Network
sar -n DEV