SAR/Sysstat

Sysstat is a facility on UNIX/Linux that collects workload data such as CPU usage, disk IOPS, etc.

On RHEL-compatible systems it is installed and enabled by default.

On UNIX systems (AIX, Solaris) you may have to install and/or enable it separately.

On UNIX systems an (excellent) alternative for sysstat is NMON.

Testing if SAR works

just type sar on the command line. You should see something like this:

# sar
Linux 4.18.0-553.89.1.el8_10.x86_64 (db01.lan)  02/12/2026  _x86_64_    (4 CPU)

12:00:00 AM     CPU     %user     %nice   %system   %iowait    %steal     %idle
12:10:24 AM     all      0,26      0,00      0,66      0,41      0,00     98,67
12:20:11 AM     all      0,24      0,00      0,61      0,35      0,00     98,80
12:30:01 AM     all      0,23      0,00      0,60      0,19      0,00     98,97
12:40:24 AM     all      0,24      0,00      0,60      0,22      0,00     98,94
12:50:11 AM     all      0,23      0,00      0,60      0,28      0,00     98,89
...

Verify if the date in the header is actual (sometimes SAR is disabled and only shows old records)

SAR file location

The directory where sysstat saves the workload data depends on the OS, distro and version.

RHEL-compatible linux: /var/log/sa

Debian-compatible linux: /var/log/sysstat

The directory usually contains two types of files: * binary sa files (sa01, sa02, ... ), one for each day in the month (up to 31) * text sar files that are daily reports (CPU usage only).

dbcollect picks up the binary sa** files and processes the files on the server.

On UNIX (AIX/Solaris), sysstat typically contains far less detailed data. The binary files cannot be processed server-side (it would require actual POWER or SPARC systems) so dbcollect generates the text files on the host first, using the sar command on AIX/SOlaris.

Enabling sysstat

On modern RHEL compatible linux systems, sysstat is managed via systemd. Check if the service is working:

# Check status of the timer - it should say enabled and active
systemctl status sysstat-collect.timer

* sysstat-collect.timer - Run system activity accounting tool every 10 minutes
   Loaded: loaded (/usr/lib/systemd/system/sysstat-collect.timer; enabled; vendor preset: disabled)
  Drop-In: /etc/systemd/system/sysstat-collect.timer.d
           └─override.conf
   Active: active (waiting) since Tue 2026-02-10 10:39:31 CET; 1 day 23h ago
  Trigger: Thu 2026-02-12 10:30:00 CET; 5min left

# enable if not enabled:
systemctl enable sysstat-collect.timer

# if sysstat is not installed (On SuSE systems this seems to be the default):
dnf install sysstat
# or
yum install sysstat
# or (suse)
zypper install sysstat

Changing the interval

On Linux, the default interval is 10 minutes. For specific purposes such as short-duration POCs or performance troubleshooting, finer resolution may be desired.

The script sysstat-timer provides a way to set the intervals. Alternatively, set the intervals on the command-line:

# Edit an override file for the sysstat timer
systemctl edit sysstat-collect.timer

# Contents of the file should look like this (where 00/1 is a 1-minute interval)
# [Timer]
# OnCalendar=
# OnCalendar=*:00/1

# Reset to the default value:
systemctl revert sysstat-collect.timer

# Reload the timer after making changes:
systemctl daemon-reload
systemctl restart sysstat-collect.timer