Tag Info

Hot answers tagged

6

This is when the cron.daily scripts run... By default, it runs daily just after 4:00am. From /etc/crontabs SHELL=/bin/bash PATH=/sbin:/bin:/usr/sbin:/usr/bin MAILTO=root HOME=/ # run-parts 01 * * * * root run-parts /etc/cron.hourly 02 4 * * * root run-parts /etc/cron.daily <-- THIS ONE!! 22 4 * * 0 root run-parts /etc/cron.weekly 42 4 1 * * root ...


4

That looks like /etc/crontab on an Ubuntu system. What about root's crontab /var/spool/cron/crontabs/root (crontab -e as root). What about the contents of /etc/cron.d (which will probably be most revealing)


4

Paging is not the same as swapping. You might have paging activity when calling executables to read portions of their binary code off disk or working with memory-mapped files. This does not (necessarily) means that swap is used. pgpin/s and pgpout/s values refer to this process. Major faults / second do measure disk read activity that needs to happen due ...


4

As stated in /etc/crontab, there is an automatic cron run scheduled at 04:02 AM, each day: [...] 02 4 * * * root run-parts /etc/cron.daily Running a ls /etc/cron.daily/ will show you the running commands scheduled for 04:02AM (they are executed sequentially). You could easily modify them to output load 'before' and after they are executed. However, if ...


3

Since you are saying that this happens at 4:10 almost everyday a crude way would be to run ps aux in cron for every minute between 4:05 to 4:15 and get the output written in a file. You can then check the %CPU usage of the command that is eating up your cpu.


3

There's also UNIX domain sockets (STREAM and DGRAM) that are accounted for in total number of sockets used by the system as it seems. UNIX domain sockets are referenced by processes as inodes in the file system. There's a lot of stuff that still uses UNIX domain sockets for various purposes so sar picks that up. Check that output of netstat -a to see how ...


3

You are trying to use a file which is not a system activity file, or whose format is no longer compatible with that of files created by current version of sar Just remove the files: rm /var/log/sa/sa??


2

Transactions are single IO-commands (fetch block/write block) that are written to the RAW-disk (in your example dm-0). The linux-kernel tries to order those commands into a better sequence or tries to compress them into more efficient commands (like: get two blocks at once instead of get one block and get another block right after this one). These are the ...


2

Process accounting should help track down which process is loading down the system. In Centos the package name is psacct. Tecmint has an article on starting with process accounting.


2

The appropriate way to do it is to NOT do it. CPU Utilization (either %used or %idle) is a bogus value to monitor - it can (and SHOULD) be 100% at various times during normal operation. Do you really want a bunch of alerts because you happened to get 5-10 web requests at the same time your monitoring system checked CPU utilization? I'm betting the answer ...


2

sar appends the day-of-month to each file, so as you've seen it will only keep one month's worth of data. To keep more, simply archive the output to another directory. sar will still be able to read them using the -f flag.


2

You can do this by setting the HISTORY parameter to the number of days you want to keep the log files. The configuration file is /etc/sysconfig/sysstat. Although the maximum number of days you can set is 28, if you want to keep the saDD format log files in the /var/log/sa directory only, you are still allowed to set it to greater than 28 days. If set to more ...


2

The -r flag for sar will give you kbmfree, kbmemused, kbbuffers, and kbcached. It doesn't, unfortunately, total them like the -/+ buffers/cache column like the free command, so you will have to pipe it through an awk or perl script to total them. Try this: sar -r |\ awk ' { if (NR > 3 && $3 != "kbmemfree" && $3 != "") { if ...


2

You may be thinking of sa rather than sar. Take a look at GNU's process accounting site. Documentation


2

Likely to be a cron job - possibly "locatedb" being updated? Adding your own cron'd output of "ps" for a night might help spot the culprit.


2

Neither -- they're just giving a different idea of CPU usage. Top's idea of CPU is "per-core" -- that is, "this program is using 100% of one core". A multithreaded program can, therefore, be using, say, "400% CPU" -- which makes the eyes water a little sometimes. On the other hand, sar sees it as as a percentage of total CPU -- so on a 4 core system, one ...


2

Have you enabled it in: /etc/default/sysstat and made sure that SA1_OPTIONS="-S DISK" is not commented out? Since you said you can get other information, I assume it is started it with /etc/init.d/sysstat start?


1

Can't speak for ubuntu but for red hat you have to change how it collects data in /usr/crond./sysstat: from: /usr/lib/sa/sa1 1 1 to: /usr/lib/sa/sa1 -d 1 1 The -d says to collect disk stats. sa1 just calls /usr/lib/sa/sadc, if you want to see the doc for it do a man sadc. This change doesn't take affect until the next time sa2 runs (I think). I ...


1

Start with top. It should list all or most of the run queue in the first page. Also 'ps r -A' will list all processes in the run queue.


1

Answering one of your question - Could please someone explain what does %steal means? steal time is a metric that only has meaning in a virtualized computing environment. It represents the amount of CPU that is taken away from a virtual machine to serve other purposes. BTW, are you running your Ubuntu server in a cloud/VMWare environment? You may ...


1

The reason this was happening was due to the cron script was being executed twice, sa2 deletes the old file and when it executes and the second time it was showing this error message as the file had already been deleted on the first run


1

Your load average remains low throughout this. I think it would be difficult to determine much with such large delays between readings. A high run queue with a corresponding high load would indicate a resource issue. I don't think that's the case here. How are you quantifying "poor performance"?


1

Almost (:-)) await is a combination of service time and wait time (latency), where you are really concerned about wait time. If your service time is on the order of 10 milliseconds, things are getting slow when the wait is as big as the service time. 10 ms is a good service time for a Sun disk array: I don't know what is a good time for your disk, but I ...


1

svctm is a measure of how long the storage took to respond after the command left the IO scheduler and the IO was no longer under the kernel's control. You're seeing less than 1ms here which is excellent. await is a measure of how long a given IO spent in the entire IO scheduler. You're seeing hundreds of milliseconds here which is pretty bad. Different ...


1

From superjami's comment, it looks like you have a bottleneck "above" the disk/array. I'd enquire of the postgres community what they recommend in the way of scheduling. In my days in Solaris, we would have used the "cray" scheduler table for a machine that was primarily a database engine... --dave


1

Install atop and configure it to save a snapshot every 60 seconds. Then, when your system goes nuts again, you can reboot and use atop -r /var/log/atop.log to go back in time and see what went wrong.


1

You can remove the sort command (and you won't need tail): sar -d -f sa28 | awk '$4 > entries[$3] {entries[$3] = $4} END {for (entry in entries) {print entry, entries[entry]}}' This will print the highest value for each device. If you want to find the one highest entry among all: sar -d -f sa28 | awk '$4 > highest {highest = $4; device = $3} END ...


1

collectd is available for FreeBSD. From the collectd website: collectd gathers statistics about the system it is running on and stores this information. Those statistics can then be used to find current performance bottlenecks (i.e. performance analysis) and predict future system load (i.e. capacity planning). Or if you just want pretty graphs of ...


1

Please also be aware that TPS value represents reads and writes, you can use -x switch for extended view where reads and writes are separated (r/s = read IOPS, w/s = write IOPS): Device: rrqm/s wrqm/s r/s w/s rsec/s wsec/s avgrq-sz avgqu-sz await svctm %util vda 0.07 24.65 0.30 18.95 30.65 330.22 18.74 ...



Only top voted, non community-wiki answers of a minimum length are eligible