LinuxQuestions.org
Review your favorite Linux distribution.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Server
User Name
Password
Linux - Server This forum is for the discussion of Linux Software used in a server related context.

Notices

Reply
 
Search this Thread
Old 02-23-2010, 07:19 AM   #1
marozsas
Senior Member
 
Registered: Dec 2005
Location: Campinas/SP - Brazil
Distribution: SuSE, RHEL, Fedora, Ubuntu
Posts: 1,393
Blog Entries: 1

Rep: Reputation: 63
who is writing to this file ?


Hi dear fellows !

There is in my CentOS 5.4 server a file which has been updated each 10 minutes or so. The file is "/var/log/sa/sa23".

Using the command "sar -f /var/log/sa/sa23" I can get stats about the server updated to the last 10 minutes. So, this file has a valid sar binary data on it.

The problem is I don't know which process is updating this file.
I couldn't find any process fired by cron/at which may explain this (find /var/spool/at -type f; find /var/spool/cron -type f), neither a process currently running (ps -ef | grep -i sa).

At times near to each 10 minutes I tried to use "lsof" to catch the process which is using the file, but it didn't return anything ("while /bin/true; do lsof /var/log/sa/sa23; done")

Searching for process with open files at /proc didn't help too, because this process don't keep the file open all the time (find /proc -type d -iname "fd" -exec ls -ltr {} \; | grep sa)

In fact, I want to change the resolution of stats returned by this hidden/mysterious sar data collector. 10 minutes is too much for a particular analysis I need to do. I want to change it for 3 seconds for a specific period of time.

The problem is the command "/usr/lib64/sa/sa1 1200 3" didn't work at all, may be because of this hidden/mysterious is already in place.

How to find which process is writing to /var/log/sa/sa23 ?
Alternatively, how to change it to capture data at 3 seconds during a specific period of time ?


[]
 
Old 02-23-2010, 07:34 AM   #2
smoker
Senior Member
 
Registered: Oct 2004
Distribution: Fedora Core 4, 12, 13, 14, 15, 17
Posts: 2,279

Rep: Reputation: 248Reputation: 248Reputation: 248
http://www.howtoforge.com/sysstat_monitoring_centos

man sar

Last edited by smoker; 02-23-2010 at 07:38 AM.
 
Old 02-23-2010, 08:54 AM   #3
kschmitt
Member
 
Registered: Jul 2009
Location: Chicago Suburbs
Distribution: Crux, CentOS, RHEL, Ubuntu
Posts: 96

Rep: Reputation: 23
sar is part of the systat package/service in CentOS/Redhat. Like smoker said, man sar

Sar is your friend, you really don't want to disable it, it helps you with all sorts of stuff.

Some things to do with sar.

Type "sar|less", and you'll see what type of load your system was under since midnight (if you want you can also specify previous days, man sar to find out more).

Type "sar -B|less" to see what your memory situation is, since midnight. If "majflts", major faults, is higher than few percent on a regular basis, you know you need more ram!

See, sar is your friend!

And for your more general question of who's writing to the file, lsof is another friend, it tells you which process has what files open. Again use less, there's a ton of output Once you're used to what it's showing you, use grep.

Good luck.
 
Old 02-23-2010, 08:56 AM   #4
kschmitt
Member
 
Registered: Jul 2009
Location: Chicago Suburbs
Distribution: Crux, CentOS, RHEL, Ubuntu
Posts: 96

Rep: Reputation: 23
*cough*

sorry, just re-read.

Short answer, edit the file in /etc/cron.d/sysstat
 
Old 02-23-2010, 10:07 AM   #5
marozsas
Senior Member
 
Registered: Dec 2005
Location: Campinas/SP - Brazil
Distribution: SuSE, RHEL, Fedora, Ubuntu
Posts: 1,393
Blog Entries: 1

Original Poster
Rep: Reputation: 63
Hey kschmitt ! Thanks !

I forgot to search for cron files at /etc...You right, /etc/cron.d/sysstat has a sa1 command scheduled to run once at each 10 minutes !

Mystery solved !
 
Old 02-23-2010, 10:35 AM   #6
smoker
Senior Member
 
Registered: Oct 2004
Distribution: Fedora Core 4, 12, 13, 14, 15, 17
Posts: 2,279

Rep: Reputation: 248Reputation: 248Reputation: 248
All of that is explained in the link I posted.
 
Old 02-23-2010, 05:24 PM   #7
marozsas
Senior Member
 
Registered: Dec 2005
Location: Campinas/SP - Brazil
Distribution: SuSE, RHEL, Fedora, Ubuntu
Posts: 1,393
Blog Entries: 1

Original Poster
Rep: Reputation: 63
ohh... I'm sorry smoker. I didn't meant to be impolite.

Thank you too !

cheers,
 
Old 02-23-2010, 06:28 PM   #8
smoker
Senior Member
 
Registered: Oct 2004
Distribution: Fedora Core 4, 12, 13, 14, 15, 17
Posts: 2,279

Rep: Reputation: 248Reputation: 248Reputation: 248
No problem.
I wasn't upset, just surprised that you didn't read it.
Too many posters want an exact answer, rather than read a page.
I'm glad you're fixed up.

regards

Alan
 
  


Reply

Tags
sar


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
NFS Large File Copies Fail - Error writing to file: Input/output error deck- Linux - Server 7 07-27-2013 11:14 AM
Error writing to file: File too large gaviono Linux - Server 3 01-23-2010 09:32 PM
Writing an ISO file for cd audio from a cue and wave file? spaz-atk Linux - Software 5 12-01-2008 01:52 AM
writing to a file ravi2ray Linux - General 3 11-13-2008 02:41 PM
writing to file ej25 Programming 17 11-19-2004 11:23 AM


All times are GMT -5. The time now is 01:20 PM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration