Prevent sar from appending data to data from the preceding month

Prevent sar from appending data to data from the preceding month

Previously, the sar utility set the maximum number of days to be logged
in one month too high. Consequently, data from a month were appended to
data from the preceding month. With this update, the maximum number of
days has been set to 25, and data from a month now correctly replaces
data from the preceding month.

From Red Hat Bugzilla #578929 (Jeff Bastian):

*** BEGIN ***
Although RHEL 4 was modified to set the max history for sar to 26 days,
this value is still too long.

Given that
  1. February only has 28 days, and
  2. that 'find ... -mtime +26' finds files that were modified 27
     or more days ago, and
  3. find ignores fractional days and thus has rounding errors, and
  4. the DST changes take place within sar's $HISTORY window
     (as of 2007, the second Sunday in March[1], or March 14, 2010
     this year)
then /usr/lib/sa/sa2 is only deleting files that are 28 days
or older (not 27).

As a result, sar data from March 15 to March 28 was getting appended
to the data from February instead of replacing it.  You can see the
files
from March 15 to 28 are 2x the size of normal files.
   # ls -al
   ...
   -rw-r--r--  1 root root  813552 Mar 12 23:50 sa12
   -rw-r--r--  1 root root  813552 Mar 13 23:50 sa13
   -rw-r--r--  1 root root  779664 Mar 14 23:50 sa14
   -rw-r--r--  1 root root 1626864 Mar 15 23:50 sa15
   -rw-r--r--  1 root root 1626864 Mar 16 23:50 sa16
   -rw-r--r--  1 root root 1626864 Mar 17 23:50 sa17
   ...
   -rw-r--r--  1 root root 1626864 Mar 26 23:50 sa26
   -rw-r--r--  1 root root 1626864 Mar 27 23:50 sa27
   -rw-r--r--  1 root root 1626864 Mar 28 23:50 sa28
   -rw-r--r--  1 root root  813552 Mar 29 23:50 sa29
   -rw-r--r--  1 root root  339120 Mar 30 09:50 sa30
   ...

The max needs to be 25 days to account for DST now.

Attached is a demo script to show how 'find ... -mtime +26 ...' fails to
find files that are 27 days old when dealing with the DST time change on
March 14, 2010.

It touches a series of files, sa10 to sa20, with timestamps from
February 10 to February 20 at 23:53.  It then sets the date to March 15
and finds files that are older than 26 days.  (And finally restores the
date.)

Stopping ntpd:                                             [  OK  ]
Stopping crond:                                            [  OK  ]
Mon Mar 15 23:53:00 EDT 2010
-rw-r--r-- 1 root root 0 Feb 15 23:53 /root/timestamp/sa15
-rw-r--r-- 1 root root 0 Feb 14 23:53 /root/timestamp/sa14
-rw-r--r-- 1 root root 0 Feb 13 23:53 /root/timestamp/sa13
-rw-r--r-- 1 root root 0 Feb 12 23:53 /root/timestamp/sa12
-rw-r--r-- 1 root root 0 Feb 11 23:53 /root/timestamp/sa11
-rw-r--r-- 1 root root 0 Feb 10 23:53 /root/timestamp/sa10
Thu Apr  1 12:35:12 EDT 2010
Starting crond:                                            [  OK  ]
Starting ntpd:                                             [  OK  ]

You can see that youngest file it found was from February 15 which is 28
days old on March 15.  It does not find sa16 which is 27 days (in our
thinking) even though we specified +26.  This is due to the rounding
errors from find ignoring fractional parts of days.
*** END ***

Signed-off-by: Sebastien GODARD <sysstat@users.noreply.github.com>