'how to query sar(sysstat) for more than one day data points

  1. I don't see 'sar' command accepts date-and-time as starttime(-s) or endtime(-e) than just time. So, how to query 'sar' for more than one day's data points by passing older datetime values(-f not going to help here). The output of the 'sar' command should have date value too as well for the data points - instead of just time in hours and minutes.
  2. I see sysstat splitting saXX data files per day-wise. Is it ok to modify the default sysstat cron entries to collect sysstat(sa1/sa2) data in a single sa file per week?

sysstat config:

cat /etc/sysconfig/sysstat
# sysstat-9.0.4 configuration file.

# How long to keep log files (in days).
# If value is greater than 28, then log files are kept in
# multiple directories, one for each month.
HISTORY=7

# Compress (using gzip or bzip2) sa and sar files older than (in days):
COMPRESSAFTER=10

# Parameters for the system activity data collector (see sadc manual page)
# which are used for the generation of log files.
SADC_OPTIONS="-S DISK"

sysstat cron entries:

cat /etc/cron.d/sysstat
# Run system activity accounting tool every 10 minutes
*/10 * * * * root /usr/lib64/sa/sa1 1 1
# 0 * * * * root /usr/lib64/sa/sa1 600 6 &
# Generate a daily summary of process accounting at 23:53
53 23 * * * root /usr/lib64/sa/sa2 -A
linuxmonitoringnetwork-monitoringsariostat


Solution 1:[1]

You cannot do it directly with sar tool. There are various tools which can load sar data and show data across dates.

e.g. ksar a java tool https://en.wikipedia.org/wiki/Ksar_(Unix_sar_grapher)

  1. convert sar binary data to text form
   for day in $(seq 27 31) $(seq -f %02g 1 4); do
       LC_ALL=C sar -A -f /var/log/sa/sa$day > /tmp/sa$day.ALL.$(hostname);
   done;
   tar -zcvf /tmp/sar_for_$(hostname).tgz /tmp/sa*.$(hostname)

  1. scp/rsync copy the .tgz back to host with ksar and extract

  2. Load each sar file

* Data > Load file
    e.g. load sa29.ALL.host1 
* Repeat:
  Data > Append from file 
    e.g. load sa30.ALL.host1 sa31.ALL.host1 sa01.ALL.host1 ...

It is faster if you append in correct day order.

Yes this is annoying and a bit painful. I have played around with appending files into one file and, well so far this is the best way. Very late answer however good question, should have an answer somewhere on the internet!

several days of data, up to a month loaded into ksar

Solution 2:[2]

You can accumulate stats for desired period and use SARChart to display nice graphical report for specific period: https://sarchart.dotsuresh.com/:

#For RedHat based distros:
ls /var/log/sa/sa?? | xargs -i sar -A -f {}  >  /tmp/sar_$(uname -n).txt 
#For Debian based distros:
ls /var/log/sysstat/sa?? | xargs -i sar -A -f {}  >  /tmp/sar_$(uname -n).txt

after generating report you need to upload it to website and it will generate graphs.

Sources

This article follows the attribution requirements of Stack Overflow and is licensed under CC BY-SA 3.0.

Source: Stack Overflow

Solution Source
Solution 1
Solution 2 Marat Gainutdinov

Related Questions