http://linuxexchange.org/questions/3068/sar-command-to-monitor-network-traffic-on-eth0-along-with-cpu-utilization-for-48-hours<p>I am trying to understand the network activity from a few servers along with CPU utilization for 48 hours only. I am new to sar and maybe i am not writing the syntax correctly.</p> <p>sar %util -n ALL eth0 -e[48:00:00] -f /tmp/piyush</p>enWed, 06 Mar 2013 23:45:13 -0500http://linuxexchange.org/questions/3068/sar-command-to-monitor-network-traffic-on-eth0-along-with-cpu-utilization-for-48-hours/3069<p>A couple of things.</p> <p>1.) eth0 isn't an option for -n. You can use ALL or a number of other items, look at man sar for a list. -n ALL, would output all network stats.</p> <p>2.) -e 48:00:00, this will never work, -e signifies the ending time, there is no 48:00:00 o'clock. 23:59:59 is the highest you can get.</p> <p>3.) %util is only a field displayed by -d. not an option.</p> <p>so you're actually looking for something like <code>sar -d -n ALL</code>. The only way I'm aware of getting a specific 48 hours would be to look at each file that encompasses that time period, and use -s and the starting time in 24 hour notation, and -e for the ending time in 24 hour notation. You'd have to do it one file at a time though. </p> <p>For instance, if i wanted 09:00 on 3/1/2013 through 09:00 3/3/2013. I'd need to use the file for 3/1/2013 and -s 09:00:00, and then get all data for the file for 3/2, and an ending time of -e 09:00:00 for 3/3.</p>rfelsburgWed, 06 Mar 2013 23:45:13 -0500http://linuxexchange.org/questions/3068/sar-command-to-monitor-network-traffic-on-eth0-along-with-cpu-utilization-for-48-hours/3069