Collecting and evaluating performance data over a period of time

System Accountant

Sar (System Activity Reporter) is an inconspicuous, small, command-line tool that originally comes from the System V world. Today, sar is indispensable for troubleshooting or tuning Unix/Linux systems. Not only does sar provide ad hoc information on many performance values, it also collects data incessantly and sorts it on a daily basis into organized binary logs.

Sar keeps seven logs by default, but it can also remember a month of events. On some operating systems, such as Ubuntu, archives reaching back even longer are possible. Thus, for each point of time in a past period, you can retrospectively determine CPU utilization or free RAM, the number of network packets transmitted, or the speed of disk I/O.

Installation

Sar is included in the repositories of all well-known Linux distributions, and the package is typically named sysstat. In addition to the binary, some scripts and cron entries need to be installed, including:

sar: The sar command is used to display collected values.
sadc: (System activity data collector) takes a predetermined number of samples at defined intervals.
sa1: A wrapper for sadc, the sal shell script passes various parameters to sadc and sends the returned data to the correct binary log. The logfiles usually reside in /var/log/sa or /var/log/sysstat (Ubuntu) and always go by the name sa<dd>, where dd is the day of the month. The script is usually called every 10 minutes by cron, although you can adjust the interval if you need more or fewer values.
sa2: This shell script rotates the daily log and compresses older logs on request. Sa2 is launched by cron once a day.
sadf: An output program for data exchange, sadf processes collected data in various formats