Hi dear fellows !

There is in my CentOS 5.4 server a file which has been updated each 10 minutes or so. The file is "/var/log/sa/sa23".

Using the command "sar -f /var/log/sa/sa23" I can get stats about the server updated to the last 10 minutes. So, this file has a valid sar binary data on it.

The problem is I don't know which process is updating this file.
I couldn't find any process fired by cron/at which may explain this (find /var/spool/at -type f; find /var/spool/cron -type f), neither a process currently running (ps -ef | grep -i sa).

At times near to each 10 minutes I tried to use "lsof" to catch the process which is using the file, but it didn't return anything ("while /bin/true; do lsof /var/log/sa/sa23; done")

Searching for process with open files at /proc didn't help too, because this process don't keep the file open all the time (find /proc -type d -iname "fd" -exec ls -ltr {} \; | grep sa)

In fact, I want to change the resolution of stats returned by this hidden/mysterious sar data collector. 10 minutes is too much for a particular analysis I need to do. I want to change it for 3 seconds for a specific period of time.

The problem is the command "/usr/lib64/sa/sa1 1200 3" didn't work at all, may be because of this hidden/mysterious is already in place.

How to find which process is writing to /var/log/sa/sa23 ?
Alternatively, how to change it to capture data at 3 seconds during a specific period of time ?


[]

http://www.howtoforge.com/sysstat_monitoring_centos

man sar

sar is part of the systat package/service in CentOS/Redhat. Like smoker said, man sar

Sar is your friend, you really don't want to disable it, it helps you with all sorts of stuff.

Some things to do with sar.

Type "sar|less", and you'll see what type of load your system was under since midnight (if you want you can also specify previous days, man sar to find out more).

Type "sar -B|less" to see what your memory situation is, since midnight. If "majflts", major faults, is higher than few percent on a regular basis, you know you need more ram!

See, sar is your friend!

And for your more general question of who's writing to the file, lsof is another friend, it tells you which process has what files open. Again use less, there's a ton of output Once you're used to what it's showing you, use grep.

Good luck.

*cough*

sorry, just re-read.

Short answer, edit the file in /etc/cron.d/sysstat

Hey kschmitt ! Thanks !

I forgot to search for cron files at /etc...You right, /etc/cron.d/sysstat has a sa1 command scheduled to run once at each 10 minutes !

Mystery solved !

All of that is explained in the link I posted.

ohh... I'm sorry smoker. I didn't meant to be impolite.

Thank you too !

cheers,

No problem.
I wasn't upset, just surprised that you didn't read it.
Too many posters want an exact answer, rather than read a page.
I'm glad you're fixed up.

regards

Alan