From SpectLog
Jump to: navigation, search

In order to get the most of the sysstat package, one should look through various system statistics (and corresponding command line switches to query it). This type of details can be easily obtained from man-pages.

Instead of data query switches, this article focuses on interaction between the components from sysstat package as well as where the data comes from and goes to.


Package sysstat is used to monitor various system performance indicators on the system.

Understanding relationships between all components makes things clearer:

  • The default binary /var/log/sa/sa## data files contain the measurement history (## is day of month).
  • The human readable /var/log/sa/sar## report files contain daily reports (## is day of month).
  • Reporting tool sar to generate reports based on data files. It can also be used as interactive tool.
  • Reporting tool sadf which in combination with sar generates reports using various formats.
  • Data collector sadc to maintain the measurement history in data files. According to its man-man page, sadc is backend used by sar tool.
  • Two cron jobs defined in /etc/cron.d/sysstat running sa1 and sa2 scripts. The sa1 script calls data collector sadc to save periodic measurements in data files. The sa2 script calls sar to produce daily reports in report files.
  • A set of *stat commands to interactively examine current system statistics (iostat, mpstat, pidstat) using no historical data. Command sar can also be used interactively.

Note that sysstat init script simply creates initial measurement snapshot on boot. The package does not have a daemon. Data collection relies on cron jobs only.

Interactive tools are supplementary to the standard system tool set - they are not related to reporting based on historical data. The cron job and scripts are simply the way to prepare historical data. The key feature is reporting itself and corresponding sadf and sar options.

According to official FAQ [1], the measurements reported by sar are average values based on differences in kernel counters on the given time interval. Kernel counters are cumulative since the system boot. The first report produced by sar is generated for the time since system boot.

There are two configuration files:

  • /etc/sysconfig/sysstat is simple configuration file which concerns only data archiving.
  • /etc/sysconfig/sysstat.ioconf file guides data collection from devices detected and listed in /proc/partitions and /proc/diskstats files files. It is not changed normally.

General usage

The sar command displays reports which require measurement data as a source. Measurement data may be obtained from prepared data files or from snapshots of current system statistic collected interactively.

Using current system statistic collected interactively

If interval parameter is specified in seconds, it uses current system data producing measurements periodically as snapshots. Optional count parameter limits number of snapshots.

sar 2
sar 2 5

Saving current system statistic for later use

Option -o specifies destination file name to save snapshots of system statistics so that the same file can be used to subsequently generate other reports with different requested information.

sar 2 5 -o

As soon as measurement data has been collected, the same report can be produced instantly by specifying the same data file using -f option:

sar -f

Note that sar command saves the whole snapshot with measurements. Different information can be requested based on the same measurement data. For example, option -A request almost all information in report:

sar -A -f

Default data files

If no interval parameter and no -f option with source data file are specified, sar generates report based on default historical data (from default /var/log/sa/sa## file) for current date.


Note that if -o is given without file name, sar still writes snapshots to the default /var/log/sa/sa## data file regardless of the requested values in the report. It means that this data will be part of measurement history in addition to data generated periodically through the cron jobs.