Let me explain what I have understood:I see in /var/log/sa/ there are two kind of files sadd and sardd.sadd is report in binary format, updated every 10 min through cron using /usr/lib64/sa/sa1, a shell script variant of /usr/lib64/sadc and sardd is report in human readable text format derived from sadd binary file, created every day through cron using /usr/lib64/sa/sa2, a shell script variant of /usr/bin/sar.Now, when we run sar WITHOUT any interval or count, it displayshistorical data of that day (input taken from the latest sardd file in the default path).When I give interval (let's say 1), it displays the realtime data.So, how does it get this data? Same as sadc, using counters in Kernel?Why I am asking this question is: I am trying to get realtime data. Let's say the following example:sar -b 1 1Linux 2.6.32-573.el6.x86_64 (myhostname.net)         10/09/2016      _x86_64_        (48 CPU)06:06:05 PM       tps      rtps      wtps   bread/s   bwrtn/s06:06:06 PM      0.00      0.00      0.00      0.00      0.00Average:         0.00      0.00      0.00      0.00      0.00And sometimes the results shows no data and some times it gives some data. But, when I see the report from historical data collected using sardc, there is some data always...Eg:Linux 2.6.32-573.el6.x86_64 (myhostname.net)         10/09/2016      _x86_64_        (48 CPU)12:00:01 AM       tps      rtps      wtps   bread/s   bwrtn/s12:10:01 AM      2.51      0.00      2.51      0.00     24.6012:20:01 AM      2.78      0.00      2.78      0.00     28.2812:30:01 AM      2.29      0.00      2.29      0.00     22.91..06:00:01 PM      3.57      0.00      3.57      0.00     36.7106:10:01 PM      2.50      0.00      2.50      0.00     25.1306:20:01 PM      2.36      0.00      2.36      0.00     23.3306:30:01 PM      3.38      0.00      3.38      0.00     35.72Average:         5.00      0.01      4.99      0.23     59.40I want to use sar to collect some realtime statistics periodically and added to cacti using snmp. So, I can not use already collected data with crons and this has to be done in realtime. And also avoid load as much as possible. The default cronjobs of /var/lib64/sa1 are with 1 interval and 1 count only. And there, the data seems valid. But with sar, the data is quite fluctuating and has zero data too. What's going on? And also I don not understand multiple utilities - one for binary files (sadc), one for text format(sar), one for different formats(sadf). Why can't all be mixed as one. There seems some difference in the process of data collection between sar and sadc.
How reliable is one interval and one count option in SAR?
monitoring;sar;sysstat