[Novalug] parsing sar data?

Jason Kohles jkohles@palantir.com
Fri May 18 10:03:25 EDT 2012


The binary format is fairly opaque, and is somewhat dependent upon things
like kernel version.  Generally you don't want to mess with it (if you
really do want to mess with it, you best option is to just modify the sar
source code to do what you want).

What you really want is 'sadf', which is similar to 'sar', but instead of
formatting it for human consumption, formats it in a manner suitable for
passing to automated tools.

Some of the arguments to sadf that you may find interesting:

-d format the output in a manner intended to be easy to ingest into a
relational database

-D like -d, but with timestamps expressed as epoch times

-p format the output in a manner that makes it easy to process with things
like awk

-x format the output as XML


-- 
Jason Kohles
Palantir Technologies | UNIX Systems Engineer
jkohles@palantir.com  | 703.957.5784







On 5/17/12 7:50 PM, "Mark Smith" <mark@winksmith.com> wrote:

anyone here have any experience parsing binary format sar data?  i want
to read the files and put them into a database for historical ease of
access.

i see a bunch of stuff to parse the textual representation, but nothing
for the binary format.

-- 
Mark Smith
mark@winksmith.com
mark@tux.org
_______________________________________________
Novalug mailing list
Novalug@calypso.tux.org
http://calypso.tux.org/mailman/listinfo/novalug
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 4634 bytes
Desc: not available
URL: <https://lists.firemountain.net/pipermail/novalug/attachments/20120518/36ed134a/attachment.p7s>


More information about the Novalug mailing list