Data is collected every 10 minutes so we can read and analyze system information. That data can be read with sar command. The script sa1 collects data every 10 minutes. The script sa2 summarizes daily information and creates a complete information report. Those scripts (sa1 and sa2) are enabled on cron.
On Ubuntu systems, the configuration file for sysstat is located at /etc/default/sysstat.
On CentOS, and other RedHat based distributions, configuration file is at /etc/sysconfig/sysstat
On Ubuntu systems, the reports are located at /var/log/sa/
On CentOS systems, sysstat reports are located inside /var/log/sysstat/sa
Once you install sysstat package, and edit the /etc/default/sysstat file, the cron automatically creates cron job for sa1 and sa2. The sa1 will run every 10 minutes and the sa2 will run once a day, each day at 23:59PM. By looking at /etc/cron.d/sysstat file, you will find cron scheduling tasks.
If you take a look inside /var/log/sa/ directory, you will find the sa* reports generated each hour by sar program. The sa* files are generated each hour, while sar* files are summary of those hourly reports (they are generated each day, by default)
Now, to view or extract data from those sa reports that have been accumulated every 10 minutes, we use sar command. To show CPU information, use the following argument: –u for CPU info, -f to specify from which file to extract data.
# sar -f /var/log/sysstat/sa16
To show the load average, use the –q argument. plist–sz shows number of running processes, ldavg-1, ldavg-5, ldavg-15 shows load average in one, five and fifthteen minutes.
If you want to see processes per second and context switch per second information, use -w argument:
To extract system information by hour, use -s and -e flags to specify start and end of the report. Command below will show CPU information from sa16 located at /var/log/sa/16, but only from 13PM to 14PM range.
# sar -u -s 13:00:00 -e 14:00:00 -f /var/log/sa/sa16