1. I don't see 'sar' command accepts date-and-time as starttime(-s) or endtime(-e) than just time. So, how to query 'sar' for more than one day's data point with older date and times(-f not going to help here). The output of the 'sar' command should have date value too as well for the data points - instead of just time in hours and minutes.
  2. I see sysstat splitting pa data files per day-wise. Is it ok to modify the default sysstat cron entries to collect sysstat(sa1/sa2) data in a single pa file per week.

sysstat config:

cat /etc/sysconfig/sysstat
# sysstat-9.0.4 configuration file.

# How long to keep log files (in days).
# If value is greater than 28, then log files are kept in
# multiple directories, one for each month.

# Compress (using gzip or bzip2) sa and sar files older than (in days):

# Parameters for the system activity data collector (see sadc manual page)
# which are used for the generation of log files.

sysstat cron entries:

cat /etc/cron.d/sysstat
# Run system activity accounting tool every 10 minutes
*/10 * * * * root /usr/lib64/sa/sa1 1 1
# 0 * * * * root /usr/lib64/sa/sa1 600 6 &
# Generate a daily summary of process accounting at 23:53
53 23 * * * root /usr/lib64/sa/sa2 -A

1 Answer 1


You cannot do so directly. sar(systat) and friends are fundamantally limited to daily records. From "sadc.c" (in sysstat-11.7.2):

 485 void setup_file_hdr(int fd)
 486 {
 507     file_hdr.sa_day         = rectime.tm_mday;
 508     file_hdr.sa_month       = rectime.tm_mon;
 509     file_hdr.sa_year        = rectime.tm_year;

So the file header contains one and only one day.

Somewhat convincing is the format of an individual record. From "sa.h":

 604 struct record_header {
 617     /*
 618      * Timestamp: Hour (0-23), minute (0-59) and second (0-59).
 619      * Used to determine TRUE time (immutable, non locale dependent time).
 620      */
 621     unsigned char hour;
 622     unsigned char minute;
 623     unsigned char second;

However, the struct also contains machine uptime in 1/100th of a second and number of seconds since the epoch. I'd have to do some more looking to see how these values are used (which I'm not going to do) so this is more of a hint rather than proof.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .