Re: How to troubleshoot this without dtrace?

In article <b68d4256-b0de-4f94-986e-a48229e8f160@xxxxxxxxxxxxxxxxxxxxxxxxxxxx>,
Jim Leonard <MobyGamer@xxxxxxxxx> writes:
(and I'd like the answer to be something other than "upgrade to
sol10" ;-)

I have a solaris 8 machine with sar output that looks like this:

00:00:01 %usr %sys %wio %idle
08:20:00 14 10 2 74
08:40:00 12 8 2 79
09:00:00 16 49 1 34
09:20:00 16 56 1 27
09:40:00 17 47 1 35

You can see at the 9:00:00 mark that the %sys column is starting to
climb, although prstat doesn't show anything new than previously (ie.
all of the same daemons are running, no new user procs).

How do I start investigating this? Is there a sar option (or
something else) that is especially suited to determining what the OS
is spending its time on?

Are you only able to look at the historical sar data, or does this
happen every 09:00:00 so you can look again tomorrow and collect
additional data?

I would start with things like vmstat, iostat, prstat -m,
intrstat. It's quite easy (and common) for a process to cause
significant %sys without actually using any significant %usr.
Is the system an NFS server? Could be NFS traffic.

If you only have that historical data, look at sar -A output.

Even on a system with dtrace, that wouldn't be my first tool
for this problem as described.

--
Andrew Gabriel
[email address is not usable -- followup in the newsgroup]
.

Relevant Pages

  • %sys skyrockets on LPAR
    ... Now we have 1 %usr against 3 %sys. ... sar & vmstat running simultaneously: ...
    (comp.unix.aix)
  • Re: Question on SAR
    ... I hit pf3 till I exited out of SAR, ... The p option will not work for me when the SAR output has been aged to tape ... Search the archives at http://bama.ua.edu/archives/ibm-main.html ...
    (bit.listserv.ibm-main)
  • [HPADM] Summary: Difficulty reading back sar output
    ... With Sar in hp-ux you use the -f flag to read from a binary file, ... Sar software versions are quite different between linux and hp-ux, ... If you wan't sar output in /var/adm/sa during the 24 ... #reduce the sar data ...
    (HP-UX-Admin)
  • [HPADM] RE: Difficulty reading back sar output
    ... To read sar info, I believe you want to use the '-f' switch, not '-o'. ... Now on my HP-UX B11.11, ... Any way I can read the HP-UX sar output on Redhat Linux 4.x? ...
    (HP-UX-Admin)