Continuous Monitoring

Interactive tools show what is happening while you watch them. Historical monitoring is needed when a slowdown has already ended. The sysstat suite collects periodic system counters, and sar reads either current counters or saved activity files.

Enabling Data Collection

Install the distribution's sysstat package, then confirm that its collector and retention mechanism are enabled. The exact service, timer, and configuration paths differ by distribution; installing the package does not guarantee collection has started.

On a systemd host, inspect the package-provided units rather than guessing their names:

$ systemctl list-unit-files | grep sysstat
$ systemctl list-timers --all | grep sysstat

Verify that new activity files are being created in the distribution's sysstat data directory and review their permissions and retention policy.

Reading Current Samples

Ask sar to collect three CPU reports at one-second intervals:

$ sar -u 1 3

Other common reports include run queue and load (-q), memory (-r), paging (-B), block devices (-d), and per-CPU activity (-P ALL). Options and fields vary with sysstat version, so consult sar --help or the local manual.

Reading Historical Files

Saved file locations and names vary, often under /var/log/sysstat or /var/log/sa. Pass a selected activity file with -f:

$ sar -q -f /var/log/sysstat/sa02

Confirm the file's full date from report headers; a two-digit suffix commonly refers to a day of the month and can be ambiguous across retention periods. Saved binary formats can also require a compatible sysstat version.

Correlating an Incident

Establish the incident time and timezone, then compare several signals across the same interval. Look for changes in load, CPU, run queue, paging, device activity, network traffic, and application latency. Counter changes show correlation, not necessarily causation; deployment records and application logs may explain the trigger.

Gaps can mean the host was down, the collector failed, or retention removed data. Monitor the monitoring pipeline itself so missing evidence is visible before an incident.

Summary

You can now use sar to investigate performance outside an interactive session.

1. Verify that collection and retention are actually active.
2. Request bounded current samples with an interval and count.
3. Select historical activity files explicitly.
4. Align several metrics with incident time and workload evidence.