This was a question I was asking myself when two of my zLinux servers (SLES9x SP3) were giving me sar output in two different ways.
One was showing time in its output as am/pm…
05:40:01 AM CPU %user %nice %system %iowait %idle
05:50:01 AM all 1.02 0.00 0.80 0.04 98.14
06:00:01 AM all 0.88 0.00 0.67 0.09 98.36
06:10:31 AM all 0.21 0.00 0.11 0.04 99.64
06:20:01 AM all 0.19 0.00 0.09 0.02 99.70
..and the other in 24hour format…
05:40:01 CPU %user %nice %system %iowait %idle
05:50:01 all 0.10 0.00 0.12 0.13 99.64
06:00:01 all 0.08 0.00 0.09 0.03 99.80
06:10:31 all 0.10 0.00 0.10 0.01 99.79
06:20:01 all 0.08 0.31 0.37 0.49 98.75
This was a problem for me since my sar_graphs.sh script, which takes sar output and makes a nice graph out of it, did not work with am/pm time format.
Instead I decided to use the -H option with sar to turn the output into "database readable" format, then change the delimeter from ";" to " ". This has the effect also of changing the time format to 24hour.
Thus…
sar -u -H | sed 's/\;/ /g'
gives me….
jdi16nf1 599 2006-12-14 09:40:01 UTC -1 0.55 0.00 0.50 0.58 98.37
jdi16nf1 600 2006-12-14 09:50:01 UTC -1 0.44 0.00 0.54 0.05 98.96
jdi16nf1 600 2006-12-14 10:00:01 UTC -1 0.41 0.00 0.42 0.78 98.39
jdi16nf1 600 2006-12-14 10:10:01 UTC -1 0.44 0.00 0.33 0.01 99.22
….which in my script I just awk out the fields I want, and pass through gnuplot. Yay!
