Howto: Sar and Ksar ( Part one )

This week a friend show me the SAR tool and ksar. So I gave it a try, and here’s how I setup the tools and few information on both tools.

SAR stand for “System Activity Report” on Linux this tool included in the sysstat package. It’s an incredible tool used to collect and display system data. SAR is the perfect tool to track down performance bottlenecks and multiple stats of your servers 24/7. The only “problem” is the readability of the displayed data.. It’s not perfect but you can find the information you are looking for, but if you are looking for a more “cute” and easy to read way to display the result, the answer is Ksar.

Ksar is a java SAR Grapher tool, it use the text file generated by SAR on Linux, Mac OS/X, Solaris, AIX, HPUX and you can load your SAR data using three different method: local file, local command execution, and remote command execution via SSH. Great isn’t ? Guest what, the tool even let you export the data in PDF/JPG/PNG/CSV.

I did this howto using Fedora 12. But as I said before you can use SAR under Linux, Mac OS/X, Solaris, AIX, HPUX.

Install and setup of SAR

First of all we will install the sysstat package, it’s available via the official Fedora repository.

# yum install sysstat

Once it’s done you will have to check  the file : /etc/cron.d/sysstat

You should see something like this:

 # cat /etc/cron.d/sysstat
 # Run system activity accounting tool every 10 minutes
 */10 * * * * root /usr/lib/sa/sa1 -S DISK 1 1
 # 0 * * * * root /usr/lib/sa/sa1 -S DISK 600 6 &
 # Generate a daily summary of process accounting at 23:53
 53 23 * * * root /usr/lib/sa/sa2 -A

We will need to generate the SAR files using C local because this is what Ksar will try to read.

According to the Ksar official Doc:

This parser use the output text file of the sar command. you need to have a spe-
cial precaution to make this file, since the parser is not locale time aware. The
parser is waiting for C locale output file

So make the /etc/crond./sysstat look like this:

# vim /etc/cron.d/sysstat
 # Run system activity accounting tool every 10 minutes
 */10 * * * * root LC_ALL=C /usr/lib/sa/sa1 -S DISK 1 1
 # 0 * * * * root /usr/lib/sa/sa1 -S DISK 600 6 &
 # Generate a daily summary of process accounting at 23:53
 53 23 * * * root LC_ALL=C /usr/lib/sa/sa2 -A

Now the sysstat cron is in place using C locale and it will gather information every 10 minutes, and generate a daily summary just before midnight. All the files generated by SAR will be put in /var/log/sa/. That’s it for the SAR part, now let’s take a look at Ksar.

Installing and using Ksar

You can download Ksar here:

An interesting fact is that you can run Ksar direct from the website if you click on the “Run kSar via webstart” you open the Ksar.jnlp and Iced Tea webstart will handle the rest of the job.

We want to install the apps locally so click on “Download the Application locally” and save the zip file on your disk.

# unzip kSar-5.0.6
# cd kSar-5.0.6

You will need to execute Ksar using the root user to access the data generated by SAR.

# sh

You’ll see a screen like this:

Now you need to load the text file in Ksar. Click on the Data menu.

And then click on “Load from text file…”

Select the file SAR has generated in /var/log/sa/sar*. The number after “sar” should be the date of the day..

The sar* file is the result of the summary process accounting generated just before midnight every day. If you can’t see it, that mean you just setup your cron and you’re before midnight, or there’s something wrong with your setup. If you’ve just setup SAR minutes ago, simply execute those commands with the root user:

# LC_ALL=C /usr/lib/sa/sa1 -S DISK 1 1
# LC_ALL=C /usr/lib/sa/sa2 -A

And you can try to load the file again, the last commands put some data in the sar files and generated the summary.

Click Ok on the “Data Import is finished” message.

Now you can see the Ksar and all the stats in the left column, and a summary on the main page.

You can navigate the left menu and select the stats you want to watch!

Here’s a screenshot of what those graph look like:

That’s it! Once your data is loaded into Ksar if you click on data, you’ll be able to export the data or select a time frame for the generated graph.

I’ll test the ssh feature to load data from a command executed on a remote host and I’ll post the result soon!




Please leave comments if there’s error or if you have suggestions!

Author: Arsenick

Hi all! I'm a 27 years old guy from Quebec city, Canada. I've been playing with Linux since 1998 and start to earn my life using Linux and FOSS around 2005. Since then I've earned few certification and courses including CLP10 (Certified Linux Professional from Novell), RHCE (RedHat Certified Engineer) and JBOSS Administration course. I'm a Linux sys admin and I'm working here in Quebec city for a small company who are RedHat Advanced partner since few years. So I'm trying to always keep me updated on new technology and new RedHat product. The best way I've found to do it is to use and contribute to the Fedora Community. So I've joined the community in mid 2009 as a Fedora Ambassadors, I still learning how everything work in a opensource community, but I really liked what I saw at the 2009 FUDCON in Toronto.

8 thoughts on “Howto: Sar and Ksar ( Part one )”

  1. I have my Ksar is working, but only display the report one day at a time only.

    How I can run the Ksar for the whole week report or maybe the whole month?
    In other words, how can I merge the sa files for example sa01 thru sa09 to be one file, so Ksar can read it as one file?

    I need some help for this



    1. You can just append data to the same file manually, or create a small script to do it for you. You can try it with something like:

      # sar -A -f /var/log/sysstat/sa01 >> jan11
      # sar -A -f /var/log/sysstat/sa02 >> jan11
      # sar -A -f /var/log/sysstat/sa03 >> jan11
      # sar -A -f /var/log/sysstat/sa04 >> jan11

      and so on… After that you can load the fine in ksar and select the time range you want!

      Hope this can help!

      1. I am not sure if there is a version discrepancy or what, but ksar won’t even load the combined week file for me using your instruction.

        Any thoughts?

      2. Strangely, your above method wouldn’t work for me. However if I cat all of the sar files into one, ksar would read them:

        for i in $(ls /var/log/sa | grep sar); do cat $i >> /var/log/sa/weekly; done

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

This site uses Akismet to reduce spam. Learn how your comment data is processed.

%d bloggers like this: