📈 sar & sysstat

# Install sysstat
sudo dnf install -y sysstat    # RHEL/Rocky
sudo apt install -y sysstat    # Debian/Ubuntu

# Enable data collection
sudo systemctl enable --now sysstat

# On Debian/Ubuntu -- also enable in the config file
sudo vi /etc/default/sysstat
# Set: ENABLED="true"
sudo systemctl restart sysstat

# Verify it is running and collecting
sudo systemctl status sysstat
ls -la /var/log/sa/

# Data files are stored as /var/log/sa/saDD (DD = day of month)
# sadc collects data every 10 minutes by default
ls -lh /var/log/sa/

# Show today's CPU activity (all samples)
sar

# CPU activity for today in real time (2 second intervals)
sar 2 10

# CPU activity from yesterday's data file
sar -f /var/log/sa/sa25

# CPU activity for a specific time range today
sar -s 14:00:00 -e 15:00:00

# Per-CPU statistics (all cores)
sar -P ALL

# Show specific CPU core
sar -P 0    # CPU 0 only

# Memory statistics
sar -r

# Memory for a time range
sar -r -s 14:00:00 -e 15:00:00

# Swap statistics
sar -S

# Memory and swap from previous day
sar -r -f /var/log/sa/sa25
sar -S -f /var/log/sa/sa25

# Huge pages
sar -H

# Disk I/O statistics
sar -d

# With human-readable device names
sar -d -p

# Disk I/O for a time range
sar -d -p -s 14:00:00 -e 15:00:00

# Block device statistics from previous day
sar -d -p -f /var/log/sa/sa25

# Network interface statistics
sar -n DEV

# Network errors
sar -n EDEV

# TCP statistics
sar -n TCP

# TCP errors
sar -n ETCP

# All network stats
sar -n ALL

# Network stats for a time range
sar -n DEV -s 14:00:00 -e 15:00:00

# mpstat -- per-CPU statistics in real time
mpstat 2 5               # all CPUs, 2 second intervals
mpstat -P ALL 2 5        # show each CPU individually
mpstat -P 0,1 2 5        # show CPU 0 and 1 only

# pidstat -- per-process CPU and I/O statistics
pidstat 2 5              # CPU stats for all active processes
pidstat -r 2 5           # memory stats
pidstat -d 2 5           # disk I/O stats per process
pidstat -u -r -d 2 5     # CPU + memory + disk combined

# pidstat for a specific process
pidstat -p 12345 2 5

# pidstat for processes matching a name
pidstat -C nginx 2 5

# Default collection is every 10 minutes
# Check the cron/timer configuration
cat /etc/cron.d/sysstat           # RHEL
systemctl cat sysstat             # systemd timer

# RHEL cron config -- /etc/cron.d/sysstat
cat /etc/cron.d/sysstat

# Change to every 5 minutes for higher resolution
sudo vi /etc/cron.d/sysstat
# Change */10 to */5

# How long are data files kept?
grep HISTORY /etc/sysstat/sysstat 2>/dev/null || grep HISTORY /etc/sysconfig/sysstat

# Extend history to 60 days (default is 7 or 28)
sudo vi /etc/sysstat/sysstat
# Set: HISTORY=60

# Manually collect a data point right now
sudo /usr/lib64/sa/sa1 1 1    # RHEL path
sudo /usr/lib/sysstat/sa1 1 1  # Debian path

#!/bin/bash
# sar-investigate.sh -- pull sar data for a specific time window
# Usage: ./sar-investigate.sh 2026-04-25 14:00 15:00

DATE=$1      # YYYY-MM-DD
START=$2     # HH:MM
END=$3       # HH:MM

if [[ -z "$DATE" || -z "$START" || -z "$END" ]]; then
    echo "Usage: $0 YYYY-MM-DD HH:MM HH:MM"
    echo "Example: $0 2026-04-25 14:00 15:00"
    exit 1
fi

# Convert date to day-of-month for sa file
DAY=$(date -d "$DATE" +%d)
SAFILE="/var/log/sa/sa$DAY"

if [[ ! -f "$SAFILE" ]]; then
    echo "No sar data found for $DATE (looked for $SAFILE)"
    exit 1
fi

echo "========================================"
echo " SAR Investigation: $DATE $START - $END"
echo "========================================"

echo ""
echo "--- CPU ---"
sar -f "$SAFILE" -s "${START}:00" -e "${END}:00"

echo ""
echo "--- MEMORY ---"
sar -r -f "$SAFILE" -s "${START}:00" -e "${END}:00"

echo ""
echo "--- DISK I/O ---"
sar -d -p -f "$SAFILE" -s "${START}:00" -e "${END}:00"

echo ""
echo "--- NETWORK ---"
sar -n DEV -f "$SAFILE" -s "${START}:00" -e "${END}:00"

echo ""
echo "--- LOAD AVERAGE ---"
sar -q -f "$SAFILE" -s "${START}:00" -e "${END}:00"

echo "========================================"