Suppose you want to have all sar info of last night 03:00 AM:

sar -A -f [sarfile] | egrep -v
> “^00:[1-9]|^01:|^02:|^04:|^05:|^06:|^07:|^08:|^09:|^10:|^00:05”
>

this give a lot of info, but reduced to that specific time period.
Here a snap of the output:

System configuration: mode=Uncapped
>
> 00:00:00 proc-sz inod-sz file-sz thrd-sz
> 03:00:00 372/262144 0/357 5117/46511 987/524288
> 03:05:00 358/262144 0/357 5043/46511 957/524288
> 03:10:00 358/262144 0/357 5012/46511 961/524288
> 03:15:00 360/262144 0/357 5042/46511 956/524288
> 03:20:00 360/262144 0/357 5053/46511 961/524288
> 03:25:00 364/262144 0/357 5085/46511 978/524288
> 03:30:00 368/262144 0/357 5071/46511 975/524288
> 03:35:00 362/262144 0/357 5076/46511 965/524288
> 03:40:00 359/262144 0/357 5042/46511 968/524288
> 03:45:00 358/262144 0/357 5045/46511 950/524288
> 03:50:00 360/262144 0/357 5060/46511 958/524288
> 03:55:00 360/262144 0/357 5075/46511 963/524288
>

Comments are closed.