We don't normally leave that entry in place, but putting it back results in sa1 running (at least twice): Mar 20 23:20:01 redmires crond[22613]: (root) CMD (/usr/lib/sa/sa1 1 1) Mar 20 23:30:01 redmires crond[22738]: (root) CMD (/usr/lib/sa/sa1 1 1) ... Perhaps /usr/lib/sa/sa1 is failing for you, or there is some other problem.