NAME 

sadf - Display data collected by sar in multiple formats.

SYNOPSIS 

sadf [ -d | -D | -H | -p | -x ] [ -t ] [ -V ] [ -P { cpu | ALL } ] [ -s [ hh:mm:ss ] ] [ -e [ hh:mm:ss ] ] [ -- sar_options... ] [ interval [ count ] ] [ datafile ]

DESCRIPTION 

The sadf command is used for displaying the contents of data files created by the sar(1) command. But unlike sar, sadf can write its data in many different formats.

The sadf command extracts and writes to standard output records saved in the datafile file. This file must have been created by a version of sar which is compatible with that of sadf. If datafile is omitted, sadf uses the standard system activity file, the /var/log/sa/sadd file, where the dd parameter indicates the current day.

The interval and count parameters are used to tell sadf to select count records at interval second intervals. If the count parameter is not set, then all the records saved in the data file will be displayed.

All the activity flags of sar may be entered on the command line to indicate which activities are to be reported. Before specifying them, put a pair of dashes (--) on the command line in order not to confuse the flags with those of sadf. Not specifying any flags selects only CPU activity.

OPTIONS 

-D
This option is equivalent to option -d below, except that the timestamp is always expressed in seconds since the epoch (00:00:00 UTC 01/01/1970).
-d
Print the contents of the data file in a format that can easily be ingested by a relational database system. The output consists of fields separated by a semicolon. Each record contains the hostname of the host where the file was created, the interval value (or -1 if not applicable), the timestamp in a form easily acceptable by most databases, and additional semicolon separated data fields as specified by sar_options command line options. Note that the timestamp is displayed in UTC (Coordinated Universal Time) unless option -t is used. In this latter case, the timestamp is displayed in local time.
-e [ hh:mm:ss ]
Set the ending time of the report. The default ending time is 18:00:00. Hours must be given in 24-hour format. Note that if you also use -p option, ending time will have to be given in UTC (Coordinated Universal Time).
-H
Display the header of the data file.
-P { cpu | ALL }
Tell sadf that processor dependent statistics are to be reported only for the specified processor or processors. Specifying the ALL keyword reports statistics for each individual processor, and globally for all processors. Note that processor 0 is the first processor.
-p
Print the contents of the data file in a format that can easily be handled by pattern processing commands like awk. The output consists of fields separated by a tab. Each record contains the hostname of the host where the file was created, the interval value (or -1 if not applicable), the timestamp (UTC value - Coordinated Universal Time) in seconds from the epoch, the device name (or - if not applicable), the field name and its value.
-s [ hh:mm:ss ]
Set the starting time of the data, causing the sadf command to extract records time-tagged at, or following, the time specified. The default starting time is 08:00. Hours must be given in 24-hour format. Note that if you also use -p option, starting time will have to be given in UTC (Coordinated Universal Time).
-t
When this option is used together with options -d or -x, the timestamp is displayed in local time instead of UTC (Coordinated Universal Time). This option is ignored when options -p or -D are used.
-V
Print version number then exit.
-x
Print the contents of the data file in XML format. Every activity and the whole file contents will be displayed. Timestamps are displayed in UTC (Coordinated Universal Time) unless option -t is used, in which case they are displayed in local time. The corresponding DTD (Document Type Definition) is included in the sysstat source package. It is also available at

ENVIRONMENT 

The sadf command takes into account the following environment variable:
S_TIME_DEF_TIME
If this variable exists and its value is UTC then sadf will use UTC time instead of local time to determine the current daily data file located in the /var/log/sa directory.

EXAMPLES 

sadf -d /var/log/sa/sa21 -- -r -n DEV
Extract memory, swap space and network statistics from system activity file 'sa21', and display them in a format that can be ingested by a database.

sadf -p -P 1

Extract CPU statistics for processor 1 (the second processor) from current daily data file, and display them in a format that can easily be handled by a pattern processing command.

FILES 

/var/log/sa/sadd
Indicate the daily data file, where the dd parameter is a number representing the day of the month.

AUTHOR 

Sebastien Godard (sysstat <at> wanadoo.fr)

SEE ALSO 

sar(1), (8), (8), (8), isag(1), mpstat(1), iostat(1), (8)