System statistics collection (sysstat)
Requires the sysstat toolkit (the sar binary) to be installed so historical system-activity metrics are collected for monitoring and incident analysis.
Checked against what is installed or registered, packages present/absent, account databases.
Why this rule matters
Without historical performance data you are blind after an event: you cannot tell whether a spike in CPU, network or disk activity preceded an outage or signalled an attack (crypto-mining, exfiltration, DoS). sysstat continuously records system activity so you can correlate resource anomalies with security events and reconstruct what the machine was doing during an incident.
What Pavois checks
Pavois checks the effective state by probing PATH for the sar binary (command -v sar). Resolving the live command is more dependable than inspecting a package manifest and directly confirms the tool an admin would actually invoke is present.
describe command('command -v sar >/dev/null 2>&1 && echo ok || echo ko') do
its('stdout.strip') { should eq 'ok' }
endHow to verify it is applied
Run command -v sar, it should print a path (e.g. /usr/bin/sar). To confirm collection is active, check the timer with systemctl status sysstat-collect.timer and that data files appear under /var/log/sysstat/ (or /var/log/sa/); sar with no args should show today's metrics.
Inspect & investigate
sysstat stores its binary data under /var/log/sysstat/ (Debian/Ubuntu) or /var/log/sa/ (RHEL), read with sar, sadf, iostat, mpstat. The collection timers are visible via systemctl list-timers | grep sysstat. Package presence: dpkg -l sysstat / rpm -q sysstat.
Remediation
No automated remediation is shipped, so apply it manually: install the package (apt install sysstat / dnf install sysstat), enable collection (set ENABLED="true" in /etc/default/sysstat on Debian/Ubuntu) and start the timers (systemctl enable --now sysstat sysstat-collect.timer sysstat-summary.timer).
Pavois applies this with its own harden engine, the plan below, not a shell script:
| command | sed -ri 's/^ENABLED=.*/ENABLED="true"/' /etc/default/sysstat 2>/dev/null; systemctl enable --now sysstat sysstat.service 2>/dev/null; true |
|---|---|
| name | enable-sysstat-collection |
| not_if | grep -q '^ENABLED="true"' /etc/default/sysstat 2>/dev/null |
| resource | exec |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Installing sysstat is non-disruptive. The only considerations are a small, regular CPU/I/O cost from the collection cron/timer and disk growth in /var/log/sysstat, tune the retention with HISTORY in /etc/sysstat/sysstat. No services are affected, and on Debian/Ubuntu remember collection is off until you set ENABLED="true".