Previous System Statistics From Sar

Question

I did see the post here: How do I get sar to show for the previous day?

But it doesn't answer my questions below.

I am trying to use sar to look at the statistics from yesterday (March 9th):

$ sar -f /var/log/sa/sa09
Linux 2.6.32-431.el6.x86_64 ([hostname])    02/09/2016  _x86_64_    (12 CPU)

I wonder why the date is Feb 9th instead of March 9th although the last modified date of the log is March 9th.

Another question is how come the statistics (from the command above) contain 48 hours of statistics? I thought the file (i.e. sa09) only contained 1 day of statistics.

Thanks!

What is the output of `ls -lArt /var/log/sa | tail -n 1` ? – Rui F Ribeiro Mar 10 '16 at 11:39 — Rui F Ribeiro, Mar 10 '16 at 11:39
sa10 with March 10th as the last modified date. – Hei Mar 10 '16 at 12:07 — Hei, Mar 10 '16 at 12:07
Odd. What about sa09 and sa08? – Rui F Ribeiro Mar 10 '16 at 12:16 — Rui F Ribeiro, Mar 10 '16 at 12:16
Both have dates that are one older than they should – Hei Mar 10 '16 at 13:31 — Hei, Mar 10 '16 at 13:31

Otheus · Answer 1 · 2016-03-11T07:31:10.513

The 09th SAR file refers to the day of the month the SAR file was created. The header is created by sar's data collector (sadc). When sar runs and finds a file there, it appends to it, unless (1) it cannot recognize the file format (version change) (2) the date is older, in which case it overwrites the file. So what probably has happened is that sadc was working in February and for some reason stopped since then. Check the cron files for "sa1" or "sadc". Make sure cron is running. Make sure sadc can append to the current sys file simply with sadc - 1 1. Now check today's file to see if it has been updated. If not, remove it and try again. (Do this as root).

EDIT: A solitary dash instructs sadc to use the standard file scheme, ie, with the day number, and it to overwrite existing is existing file's date is different than today's.

Previous System Statistics From Sar

1 Answers1