sadf

sadf [ options ] [ <interval> [ <count> ] ] [ <sarfile> ]

Common Options:
sadf -C [ <sarfile> ]
sadf -j [ -H ] [ -P { CPU | ALL } ] [ -s [ hh:mm:ss ] ] [ -e [ hh:mm:ss ] ] [ <sarfile> ]
sadf -x [ -H ] [ -P { CPU | ALL } ] [ -s [ hh:mm:ss ] ] [ -e [ hh:mm:ss ] ] [ <sarfile> ]

<interval>
    Time in seconds between samples to be reported. Used for real-time reporting if no <sarfile> is specified.

<count>
    Number of samples to be collected or reported. Used for real-time reporting if no <sarfile> is specified.

<sarfile>
    Path to the sar data file to process (e.g., /var/log/sysstat/saDD where DD is the day of the month). If omitted, sadf processes the current day's file.

-C
    Write sar data from multiple files in CSV format. This option is used when concatenating data from different sar data files.

-D
    Display sar data in a format readable by the sar command. This is the default output format when no other format options (like -j, -x) are specified.

-g
    Display sar data in SVG (Scalable Vector Graphics) format. This can be used for basic graphical representation of metrics.

-H
    Display only the header for CSV, XML, or JSON output. Useful for understanding the structure of the data without processing the entire file.

-j
    Display sar data in JSON format, making it easy to parse with scripting languages and integrate into web applications.

-L
    Display sar data in local time instead of Coordinated Universal Time (UTC) which is the default.

-P { CPU | ALL }
    Report activity for a specific processor (e.g., -P 0 for the first CPU) or for all processors (-P ALL).

-p
    Display sar data in a "pretty print" format, which is similar to sar's traditional columnar output but can also be used to concatenate data from multiple files.

-s [ hh:mm:ss ]
    Set the starting time of the report. Data collected before this time will not be displayed.

-e [ hh:mm:ss ]
    Set the ending time of the report. Data collected after this time will not be displayed.

-t [ hh:mm:ss ]
    Set the time interval of the records displayed. This can be used to filter data based on the collection interval.

-T
    Display timestamps for each record, providing precise timing information alongside the metrics.

-x
    Display sar data in XML format, providing a structured and extensible way to represent the system activity data.

-V
    Print the version number of the sysstat utilities, which includes sadf.

-v
    Print the sadf version number.

-h
    Print a help message and exit.

sadf (System Activity Data File) is a utility within the sysstat package used to read and display data collected by the sar command. Unlike sar which primarily displays data in a human-readable, columnar format, sadf offers options to export this system activity information into machine-parsable formats such as CSV (Comma Separated Values), XML, or JSON. This makes sadf invaluable for scripting, data analysis, integration with other tools, or long-term archiving of performance data. It can process real-time data or historical data stored in sar data files, allowing users to analyze system performance metrics like CPU utilization, memory usage, I/O activity, network statistics, and more, in a structured way.

sadf's functionality is entirely dependent on the availability and integrity of sar data files. If sar is not configured to collect data, or if the data files are missing or corrupted, sadf will not be able to generate reports.
For large datasets, the XML, JSON, or CSV output can be very verbose, potentially consuming significant disk space or memory if not handled efficiently. External parsing tools are often required for effective analysis of these outputs.

sadf supports several output formats, making it highly flexible for various use cases:
- CSV (Comma Separated Values): Generated using options like -C, ideal for spreadsheet analysis and simple scripting.
- XML: Generated with the -x option, providing a structured data format suitable for parsing with XML parsers.
- JSON: Generated with the -j option, a lightweight, human-readable data format widely used in web applications and scripting for data exchange.
- "Pretty Print": Generated with the -p option, which mimics sar's traditional columnar output but can combine data from multiple files.
- SVG (Scalable Vector Graphics): Generated with the -g option, useful for simple visualizations.
These diverse formats are crucial for enabling automated performance monitoring, data warehousing, and seamless integration with external visualization and analysis tools.

sadf is an integral part of the sysstat package, which originated in the late 1990s as a set of tools for collecting and reporting Linux system activity. sadf specifically gained prominence with the increasing need for machine-readable output of performance data, evolving from simple text formats to support CSV, XML, and JSON. Its development has mirrored the growing complexity of Linux system performance analysis, facilitating automation, integration with monitoring systems, and advanced data analytics.

sar(1), sa(8), iostat(1), mpstat(1), pidstat(1), vmstat(8)