Initially, I was getting errors about a var/log directory not existing when I ran 'sar'. I checked the config file for sysstat and ENABLED was already set to true. I manually started the sysstat init script and now instead of getting that error when running sar, I get this:

Linux 2.4.18 (blah) 01/10/06

01:23:33 LINUX RESTART


My understanding was I shouldn't have to restart the server? However, 1:23:33 is about 14 hours ago. I can't restart the server because it is remote and in production.

I'm not really sure how to debug or resolve this as I've never encountered a problem with sar before. Any suggestions?

I'm running sar version 6.0.2

Thank you.

The "LINUX RESTART" is the output of sar and is just telling you that's what sar has in it for the LAST time Linux restarted. It is NOT telling you to restart now.

The missing directory was likely /var/log/sa. By default sar attempts to query the current day's sar file in that directory. It is this file that contains the "LINUX RESTART". This is only created in that directory if you are running something like sysstat to do sa1 or sa2 to output there on a daily basis.



Even without the historical information in /var/log/sa you can see CURRENT activity simply by running sar with the interval and iterations options:

e.g. sar -b 5 5

Should produce something like:

Linux 2.4.18-3smp (hostname.domain.com) 01/11/2006

11:14:14 AM tps rtps wtps bread/s bwrtn/s
11:14:19 AM 30.40 0.00 30.40 0.00 368.00
11:14:24 AM 9.60 0.00 9.60 0.00 118.40
11:14:29 AM 19.20 0.00 19.20 0.00 204.80
11:14:34 AM 19.20 0.00 19.20 0.00 204.80
11:14:39 AM 19.20 0.00 19.20 0.00 204.80
Average: 19.52 0.00 19.52 0.00 220.16

You can do it without -b but you'll get every metric sar collects. Doing man or info on sar will let you know what the various metrics are (as for example what "-b" tells you).