SADF(1)

📦
version 12.8.0 · 8 versions
, in arch rolling, nixpkgs unstable

✨ NAME ✨

sadf — literally the tool that displays all the data sar collected, but in like a million different formats 💅 (this is sadf(1) from the Linux User's Manual, hi bestie 🫶)

🌸 SYNOPSIS 🌸

sadf [ -C ] [ -c | -d | -g | -j | -l | -p | -r | -x ] [ -H ] [ -h ] [ -T
| -t | -U ] [ -V ] [ -O opts [,...] ] [ -P { cpu_list | ALL } ] [ -s [
start_time ] ] ] [ -e [ end_time ] ] ] [ --dev=dev_list ] [ --fs=fs_list
] [ --iface=iface_list] [ --int=int_list ] [ -- sar_options ] [ interval
[ count ] ] [ datafile | -[0-9]+ ]

🦋 DESCRIPTION 🦋

Okay so sadf is the main character that shows you what's inside the data files that sar(1) made 👑. But here's the plot twist: unlike sar, sadf can write that data out in so many different formats — CSV, XML, and more — it's giving versatility, honestly. The default format is the kind that pattern-processing commands like awk can handle super easily (peep option -p 👀). And sadf can also draw graphs for all the activities sar collected and show them as SVG (Scalable Vector Graphics) graphics right in your web browser (peep option -g 🎨).

sadf extracts those records saved in the datafile file and writes them to standard output. That file has to have been created by a version of sar that's compatible with your version of sadf, no cap — mismatched versions are not the vibe 😭. If datafile is left out, sadf uses the standard system activity daily data file instead. You can also pass -1, -2 etc. as an argument to sadf to see the data from that many days ago — like, -1 points at yesterday's standard system activity file. Obsessed, actually ✨.

The standard system activity daily data file is named saDD or saYYYYMMDD, where YYYY is the current year, MM is the current month and DD is the current day. sadf looks for the most recent of saDD and saYYYYMMDD, and uses it. By default it lives in the /var/log/sa directory. But you can point it somewhere else: if datafile is a directory (instead of a plain file), then it gets treated as the directory where the standard system activity daily data file is located 🗂️.

The interval and count parameters tell sadf to select count records at interval seconds apart. If count isn't set, then literally all the records saved in the data file get displayed. All of them. The whole thing. 💀

Here's the part where you gotta be careful bestie 🙈: all the activity flags of sar can be entered on the command line to say which activities get reported. But before you specify them, put a pair of dashes (--) on the command line so the flags don't get confused with sadf's own flags. Not specifying any flags selects only CPU activity — that's the default, periodt.

💅 OPTIONS 💅

  • -C — Tells sadf to display the comments that are present in the file 💬.
  • -c — Converts an old system activity binary datafile (version 9.1.6 and later) to the current up-to-date format. Use this syntax, exactly:
sadf -c old_datafile > new_datafile

The conversion can be controlled using option -O (scroll down, it's there 🫶).

  • -d — Prints the contents of the data file in a format that a relational database system can ingest super easily. The output is fields separated by a semicolon. Each record contains the hostname of the host where the file was created, the interval value (or -1 if it's not applicable), the timestamp in a form that most databases will happily accept, plus additional semicolon-separated data fields as specified by the sar_options command line options. Note that the timestamp output can be controlled by options -T, -t and -U ⏰.
  • --dev=dev_list — Specifies the block devices whose statistics sadf should display. dev_list is a list of comma-separated device names. Useful with option -d from sar 💾.
  • -e [ hh:mm[:ss] ] -e [ seconds_since_the_epoch ] — Sets the ending time of the report. The default ending time is 18:00:00. Hours must be given in 24-hour format, or as the number of seconds since the epoch (given as a 10 digit number) 🕕.
  • --fs=fs_list — Specifies the filesystems whose statistics sadf should display. fs_list is a list of comma-separated filesystem device names and/or mountpoints. Either form is accepted for filtering — both work, iykyk. Useful with option -F from sar 🗄️.
  • -g — Prints the contents of the data file in SVG (Scalable Vector Graphics) format. This option lets you display some fancy graphs in your web browser 🌈. Use this syntax:
sadf -g your_datafile [ -- sar_options ] > output.svg

and then open the resulting SVG file in your favorite web browser. The output can be controlled using option -O (again, it's below 👇).

  • -H — Displays only the header of the report (when applicable). If no format has been specified, then the header data (the metadata) of the data file is what gets displayed 🏷️.
  • -h — When used together with option -d, all activities get displayed horizontally on a single line. One line. Everything. Slay 📏.
  • --iface=iface_list — Specifies the network interfaces whose statistics sadf should display. iface_list is a list of comma-separated interface names. Useful with options -n DEV and -n EDEV from sar 🌐.
  • --int=int_list — Specifies the interrupts names whose statistics sadf should display. int_list is a list of comma-separated values or range of values (e.g., 0-16,35,40-). Useful with option -I from sar ⚡.
  • -j — Prints the contents of the data file in JSON (JavaScript Object Notation) format. Timestamps can be controlled by options -T and -t 🧾.
  • -l — Exports the contents of the data file to a PCP (Performance Co-Pilot) archive. The name of the archive can be specified using the keyword pcparchive= with option -O 📦.
  • -O opts[,...] — Uses the specified options to control the output of sadf. The following options control the SVG output displayed by sadf -g:
    • autoscale — Draws all the graphs of a given view as large as possible based on the current view's scale. To do this, a factor (10, 100, 1000...) is used to enlarge the graph drawing. This option may be interesting when several graphs are drawn on the same view, some with only very small values, and others with high ones — the high ones making the small ones hardly visible 😭.
    • bwcol — Uses a black and white palette to draw the graphs 🖤🤍.
    • customcol — Uses a customizable color palette instead of the default one to draw the graphs. See environment variable S_COLORS_PALETTE below to know how to customize that palette 🎨.
    • debug — Adds helpful comments in the SVG output file 🐛.
    • height=value — Sets the SVG canvas height to value 📐.
    • oneday — Displays graphs data over a period of 24 hours. Note that hours are still printed in UTC by default: you should use option -T to print them in local time and get a time window starting from midnight 🌙.
    • packed — Groups all views from the same activity (and for the same device) on the same row 🧳.
    • showidle — Also displays the %idle state in graphs for CPU statistics 💤.
    • showinfo — Displays additional information (such as the date and the host name) on each view ℹ️.
    • showtoc — Adds a table of contents at the beginning of the SVG output, consisting of links pointing at the first graph of each activity 📑.
    • skipempty — Does not display views where all graphs have only zero values 🚫.

The following option may be used when converting an old system activity binary datafile to current up-to-date format:

  • hz=value — Specifies the number of ticks per second for the machine where the old datafile has been created ⏱️.

The following option may be used when data are exported to a PCP archive:

  • pcparchive=name — Specifies the name of the PCP archive to create 🗃️.

The following option is used to control raw output displayed by sadf -r:

  • debug — Displays additional information, mainly useful for debugging purposes 🐞.
  • -P { cpu_list | ALL } — Tells sadf that processor-dependent statistics are to be reported only for the specified processor or processors. cpu_list is a list of comma-separated values or range of values (e.g., 0,2,4-7,12-). Note that processor 0 is the first processor, and processor all is the global average among all processors. Specifying the ALL keyword reports statistics for each individual processor, and globally for all processors 🖥️.
  • -p — Prints the contents of the data file in a format that pattern processing commands like awk can handle super easily. The output is fields separated by a tab. Each record contains the hostname of the host where the file was created, the interval value (or -1 if not applicable), the timestamp, the device name (or - if not applicable), the field name and its value. Note that the timestamp output can be controlled by options -T, -t and -U ⏰.
  • -r — Prints the raw contents of the data file. With this format, the values for all the counters are displayed as read from the kernel, which means e.g. that no average values are calculated over the elapsed time interval — it's the raw realness, no smoothing 🧃. The output can be controlled using option -O (see above).
  • -s [ hh:mm[:ss] ] -s [ seconds_since_the_epoch ] — Sets the starting time of the report. The default starting time is 08:00:00. Hours must be given in 24-hour format, or as the number of seconds since the epoch (given as a 10 digit number) 🕗.
  • -T — Displays the timestamp in local time instead of UTC (Coordinated Universal Time) 🕰️.
  • -t — Displays the timestamp in the original local time of the data file creator instead of UTC (Coordinated Universal Time) 🌍.
  • -U — Displays the timestamp (UTC — Coordinated Universal Time) in seconds from the epoch 🔢.
  • -V — Prints the version number then exits. Short and iconic 👋.
  • -x — Prints the contents of the data file in XML format. Timestamps can be controlled by options -T and -t. The corresponding DTD (Document Type Definition) and XML Schema are included in the sysstat source package. They're also available at https://sysstat.github.io/ 🔗.

✨ ENVIRONMENT ✨

okay bestie, sadf also peeks at your environment variables 👀 here's the whole roster:

  • S_COLORS_PALETTE — this one sets the colors that sadf -g uses to render the SVG output. big caveat: it's only taken into account when you've picked the custom color palette with the option customcol (see option -O). its value is a colon-separated list of capabilities mapped to six-digit, three-byte hexadecimal numbers (hex triplets) representing colors, and it defaults to:
0=000000:1=1a1aff:2=1affb2:3=b21aff:
4=1ab2ff:5=ff1a1a:6=ffb31a:7=b2ff1a:
8=efefef:9=000000:A=1a1aff:B=1affb2:
C=b21aff:D=1ab2ff:E=ff1a1a:F=ffb31a:
G=bebebe:H=000000:I=000000:K=ffffff:
L=000000:T=000000:W=000000:X=000000

capabilities that are just a single hexadecimal digit (0 through F) specify the first sixteen colors in the palette — those are the ones used to draw the graphs 🎨 so like, 3=ffffff would mean the third color in the palette is white (0xffffff). the other capabilities are:

  • G= — the color used to draw the grid lines.
  • H= — the color used to display the report header.
  • I= — the color used to display additional information (e.g., date, hostname...).
  • K= — the color used for the graphs background.
  • L= — the default color (which is for example used to display the table of contents).
  • T= — the color used to display the graphs title.
  • W= — the color used to display warning and error messages.
  • X= — the color used to draw the axes and display the graduations.
  • S_TIME_DEF_TIME — if this variable exists and its value is UTC, then sadf will use UTC time instead of local time to figure out which current daily data file lives in the /var/log/sa directory. clock stuff, iykyk 🕰️

🌸 EXAMPLES 🌸

real ones, in action:

sadf -d /var/log/sa/sa21 -- -r -n DEV

extract memory and network statistics from the system activity file sa21, and display them in a format that can be ingested by a database. literally feeding your db, no cap 💾

sadf -p -P 1

extract CPU statistics for processor 1 (the second processor, yes, zero-indexed bestie 😭) from the current daily data file, and display them in a format that can easily be handled by a pattern processing command. grep girlies rejoice 🫶

💀 BUGS 💀

so the SVG output (as created by option -g) is fully compliant with the SVG 1.1 standard. graphics have been successfully displayed in various web browsers, including Firefox, Chrome and Opera. but — and I cannot stress this enough — SVG rendering is broken on Microsoft browsers (tested on Internet Explorer 11 and Edge 13.1). so please don't use them. like, don't. I'm begging 🙈

🎀 FILES 🎀

  • /var/log/sa/saDD
  • /var/log/sa/saYYYYMMDD

these are the standard system activity daily data files and their default location. YYYY stands for the current year, MM for the current month and DD for the current day. that's the whole naming scheme, iconic and simple ✨

👑 AUTHOR 👑

Sebastien Godard (sysstat <at> orange.fr) — the main character who made all this happen 💅

🌈 SEE ALSO 🌈

sar(1), sadc(8), sa1(8), sa2(8), sysstat(5)

and if you wanna stan further:

okay that's the whole page bestie, you're fully caught up 🫶 this one's from the Linux manual, AUGUST 2026, and it's the SADF(1) page — go forth and sadf responsibly, ily, mwah 💖✨🎀

📦 where this page comes from