简体   繁体   中英

how to query sar(sysstat) for more than one day data points

  1. I don't see 'sar' command accepts date-and-time as starttime(-s) or endtime(-e) than just time. So, how to query 'sar' for more than one day's data points by passing older datetime values(-f not going to help here). The output of the 'sar' command should have date value too as well for the data points - instead of just time in hours and minutes.
  2. I see sysstat splitting saXX data files per day-wise. Is it ok to modify the default sysstat cron entries to collect sysstat(sa1/sa2) data in a single sa file per week?

sysstat config:

cat /etc/sysconfig/sysstat
# sysstat-9.0.4 configuration file.

# How long to keep log files (in days).
# If value is greater than 28, then log files are kept in
# multiple directories, one for each month.
HISTORY=7

# Compress (using gzip or bzip2) sa and sar files older than (in days):
COMPRESSAFTER=10

# Parameters for the system activity data collector (see sadc manual page)
# which are used for the generation of log files.
SADC_OPTIONS="-S DISK"

sysstat cron entries:

cat /etc/cron.d/sysstat
# Run system activity accounting tool every 10 minutes
*/10 * * * * root /usr/lib64/sa/sa1 1 1
# 0 * * * * root /usr/lib64/sa/sa1 600 6 &
# Generate a daily summary of process accounting at 23:53
53 23 * * * root /usr/lib64/sa/sa2 -A

You can accumulate stats for desired period and use SARChart to display nice graphical report for specific period: https://sarchart.dotsuresh.com/ :

#For RedHat based distros:
ls /var/log/sa/sa?? | xargs -i sar -A -f {}  >  /tmp/sar_$(uname -n).txt 
#For Debian based distros:
ls /var/log/sysstat/sa?? | xargs -i sar -A -f {}  >  /tmp/sar_$(uname -n).txt 

after generating report you need to upload it to website and it will generate graphs.

You cannot do it directly with sar tool. There are various tools which can load sar data and show data across dates.

eg ksar a java tool https://en.wikipedia.org/wiki/Ksar_(Unix_sar_grapher)

  1. convert sar binary data to text form
   for day in $(seq 27 31) $(seq -f %02g 1 4); do
       LC_ALL=C sar -A -f /var/log/sa/sa$day > /tmp/sa$day.ALL.$(hostname);
   done;
   tar -zcvf /tmp/sar_for_$(hostname).tgz /tmp/sa*.$(hostname)
  1. scp/rsync copy the .tgz back to host with ksar and extract

  2. Load each sar file

* Data > Load file
    e.g. load sa29.ALL.host1 
* Repeat:
  Data > Append from file 
    e.g. load sa30.ALL.host1 sa31.ALL.host1 sa01.ALL.host1 ...

It is faster if you append in correct day order.

Yes this is annoying and a bit painful. I have played around with appending files into one file and, well so far this is the best way. Very late answer however good question, should have an answer somewhere on the internet!

几天的数据,最多一个月的数据加载到 ksar

The technical post webpages of this site follow the CC BY-SA 4.0 protocol. If you need to reprint, please indicate the site URL or the original address.Any question please contact:yoyou2525@163.com.

 
粤ICP备18138465号  © 2020-2024 STACKOOM.COM