如何查询sar（sysstat）多日数据点及修改采集配置的疑问

Alright, let's break down your sar-related questions step by step—these are super common pain points when working with historical system stats, so I’ve got practical, actionable solutions for you.

1. 查询多日数据并让输出包含完整日期 #

You’re right: sar’s -s and -e flags only accept time formats (like 09:00:00), not full datetime strings. To pull stats across multiple days and get output with full dates, sadf—a tool included with sysstat—is your best bet. It’s designed to handle multiple sar data files and format output with proper timestamps.

Here are some useful examples:

• CSV format for easy analysis: Pull CPU usage from May 20th to 22nd, 8 AM to 6 PM, with full datetimes:

  sadf -d /var/log/sa/sa20 /var/log/sa/sa21 /var/log/sa/sa22 -- -u -s 08:00:00 -e 18:00:00
  

  • -d outputs CSV (great for spreadsheets or scripts)
  • /var/log/sa/saXX are the daily sar data files (XX is the day of the month)
  • -- separates sadf flags from sar’s own stats flags (here -u for CPU stats)
  • -s/-e define the time window for each day

• Human-readable text format: Check memory stats from May 15th to 17th, 9 AM to 5 PM:

  sadf -p /var/log/sa/sa[15-17] -- -r -s 09:00:00 -e 17:00:00
  

  -p gives you clean lines like 2024-05-15 09:00:00 3.12 15.45 ... with full datetimes.

• Wildcard for date ranges: If your sysstat uses saYYYYMMDD named files (archived daily), you can match a whole month:

  sadf -p /var/log/sa/sa202405* -- -n DEV -s 12:00:00 -e 14:00:00
  

  This pulls network interface stats for all days in May 2024, between 12 PM and 2 PM.

2. Modify sysstat cron to store data in a single file #

By default, sysstat’s sa1 (raw data collection) and sa2 (summary reports) split files daily via cron. To force them to use one single file, you’ll need to adjust the cron jobs and command parameters:

Step 1: Update the sa1 cron job #

The default sa1 cron runs every 10 minutes and auto-creates a daily file. To point it to a fixed file:

1. Open your sysstat cron config (usually /etc/cron.d/sysstat or check crontab -e for root)
2. Find the line that looks like this:

   */10 * * * * root /usr/lib64/sa/sa1 1 1
   

3. Modify it to specify your single file path (e.g., /var/log/sa/sa_all):

   */10 * * * * root /usr/lib64/sa/sa1 1 1 -S ALL /var/log/sa/sa_all
   

   • -S ALL enables all available stats (optional—trim to what you need if you want smaller files)
   • The final path is your fixed raw data file

Step 2: Update the sa2 cron job (for daily summaries) #

If you use sa2 to generate daily sar reports, adjust it to use your single file:

1. Find the default sa2 line (usually runs at 23:53):

   53 23 * * * root /usr/lib64/sa/sa2 -A
   

2. Modify it to reference your single file:

   53 23 * * * root /usr/lib64/sa/sa2 -A -f /var/log/sa/sa_all
   

Important notes #

• File size management: A single file will grow over time—set up a monthly archive to avoid disk bloat:

  mv /var/log/sa/sa_all /var/log/sa/sa_all_$(date +%Y%m) && touch /var/log/sa/sa_all
  

• Restart cron: After editing, restart the cron service to apply changes:

  systemctl restart crond
  

• Path differences: On Debian/Ubuntu, the sa1/sa2 path is /usr/lib/sysstat/sa1—use which sa1 to confirm your system’s path.

内容的提问来源于stack exchange，提问作者Murali Mopuru