Using sar and kSar
8:21 PM
When investigating performance issues, sar and kSar will be your best friends for quickly zeroing in on the cause.
By default, it runs every 10 minutes, collecting 1 data point. This is too few data points for doing analysis. I would recommend changing the cron job so the sa1 command runs every 2 minutes. This will give you more data points and produces better graphs in kSar for finding peaks and valleys in the data.
The sa1 command, which performs the work of collecting the data, subtracts out it's resources from the data so as to not skew the results. And since it grabs the data from the /proc file system, it incurs very little overhead, especially disk I/O.
A 2nd cron job, the sa2 command, runs nightly just before midnight to generate a text report from the day's data file. This report can be viewed in any text editor and can be used as input for kSar.
A note on the files: in the /var/log/sa directory will be 2 sets of files. Both sets of files end with 2 digits that correspond to the date when the data was collected/generated. Files named saXX (where XX are digits) are the compact, binary data files written to by the sa1 command and read by the sa2 and sar commands. Files named sarXX (where XX are digits) are the text reports generated by the sa2 command.
The sa2 command takes care of pruning old data files and reports. By default, it keeps 7 days of data and reports. This can be controlled by the /etc/sysconfig/sysstat configuration file on Red Hat (and Red Hat-derived distros like CentOS and Oracle Linux.)
To view data from the current day's data file, you can use the sar command. By default, it display CPU statistics. There are many options to control which data to view so check the man page for the particular parameter(s) you need.
After running kSar, you can load a sarXX report by going to the "Data" menu and clicking on "Load from text file...". It is possible to connect kSar to a remote server using ssh.
(NOTE
after RHEL 6.4 sysstat sar format has changed. kSar will no longer be able to graph data.
How it works
The data collector and report generator in the sysstat package are executed out of the system crontab (/etc/cron.d/sysstat.) The system collects data points from the /proc file system and stores them in a compact format in the /var/log/sa directory.By default, it runs every 10 minutes, collecting 1 data point. This is too few data points for doing analysis. I would recommend changing the cron job so the sa1 command runs every 2 minutes. This will give you more data points and produces better graphs in kSar for finding peaks and valleys in the data.
The sa1 command, which performs the work of collecting the data, subtracts out it's resources from the data so as to not skew the results. And since it grabs the data from the /proc file system, it incurs very little overhead, especially disk I/O.
A 2nd cron job, the sa2 command, runs nightly just before midnight to generate a text report from the day's data file. This report can be viewed in any text editor and can be used as input for kSar.
A note on the files: in the /var/log/sa directory will be 2 sets of files. Both sets of files end with 2 digits that correspond to the date when the data was collected/generated. Files named saXX (where XX are digits) are the compact, binary data files written to by the sa1 command and read by the sa2 and sar commands. Files named sarXX (where XX are digits) are the text reports generated by the sa2 command.
The sa2 command takes care of pruning old data files and reports. By default, it keeps 7 days of data and reports. This can be controlled by the /etc/sysconfig/sysstat configuration file on Red Hat (and Red Hat-derived distros like CentOS and Oracle Linux.)
To view data from the current day's data file, you can use the sar command. By default, it display CPU statistics. There are many options to control which data to view so check the man page for the particular parameter(s) you need.
kSar
kSar is a separate package that can be used to visualize the data collected by sysstat. It can even generate images or a PDF file so the graphs can be easily shared. You can download kSar from http://sourceforge.net/projects/ksar/. It's a Java application so a JDK or JRE is required to run it.After running kSar, you can load a sarXX report by going to the "Data" menu and clicking on "Load from text file...". It is possible to connect kSar to a remote server using ssh.
(NOTE
after RHEL 6.4 sysstat sar format has changed. kSar will no longer be able to graph data. 
0 comments