linux sar - ghdrako/doc_snipets GitHub Wiki

sar (meaning System Activity Report ) monitors CPU activity, memory, paging, device load, and network activity. It’s readily available (and usually already running) on most modern Linux installations via the sysstat package; this makes it very useful for situations where the customer either doesn’t have monitoring set up or won’t let you access it.

Find out if sar is already enabled and running by checking for collected data in /var/log/sa (CentOS) or /var/log/sysstat (Ubuntu). saXX files are binary data; sarXX are converted text. Check the poll cycle by looking at the appropriate crontab in /etc/cron.d/sysstat. The default is 10 minutes; determine if this is frequent enough for your purposes. Verify that collection of disk stats is enabled in the config file: /etc/sysconfig/sysstat (CentOS) or /etc/default/sysstat (Ubuntu). You should find an OPTIONS parameter set to “-S DISK.” If sar is already running, you can just use the already collected statistics. Only the binary data files will hold the most recent poll; the conversion to text only happens once daily, so if you want immediate stats, you need to run the conversion yourself. If sar is not running, you can manually collect the data :

sar [stats options] -o [output_file] [poll interval in seconds] [number of polls]

An example is:
sar -A -o my_cool_stats 60 30-A = collect all stats
-o = store stats in this file (in binary format)
60 = collect every 60 seconds
30 = collect 30 times
Note that the -A option generates about 18MB of data per poll; plan space accordingly.
You can then use the following command to generate a report:
sar -A -f my_cool_stats > my_cool_stats.txt