topic Re: sar command in Operating System - HP-UX

sar command

Tonatiuh — Fri, 11 Mar 2005 14:59:56 GMT

HP-UX 11.11

can anyone help me to know the meaning of this values?

# sar -v 2 10

HP-UX IAS001 B.11.11 U 9000/800 03/11/05

20:44:26 text-sz ov proc-sz ov inod-sz ov file-sz ov
20:44:28 N/A N/A 307/25640 0 1042/27408 0 4019/44011 0
20:44:30 N/A N/A 307/25640 0 1042/27408 0 4020/44011 0
20:44:32 N/A N/A 306/25640 0 1040/27408 0 4014/44011 0
20:44:34 N/A N/A 306/25640 0 1041/27408 0 4021/44011 0
20:44:36 N/A N/A 307/25640 0 1041/27408 0 4020/44011 0
20:44:38 N/A N/A 307/25640 0 1042/27408 0 4026/44011 0
20:44:40 N/A N/A 306/25640 0 1042/27408 0 4023/44011 0
20:44:42 N/A N/A 306/25640 0 1040/27408 0 4025/44011 0
20:44:44 N/A N/A 306/25640 0 1040/27408 0 4022/44011 0
20:44:46 N/A N/A 306/25640 0 1040/27408 0 4029/44011 0

Thanks in advance!

Re: sar command

Steven E. Protter — Fri, 11 Mar 2005 15:06:03 GMT

-v Report status of text, process, inode and file tables:
text-sz (Not Applicable);
proc-sz The current-size and maximum-size of the process table;
inod-sz The current-size and maximum-size of the inode table (inode cache);
file-sz The current-size and maximum-size of the system file table;
text-ov (Not Applicable);
proc-ov The number of times the process table overflowed (number of times the kernel could not find any available process table entries) between sample points;

From the man page.

SEP

Re: sar command

Tonatiuh — Fri, 11 Mar 2005 19:26:36 GMT

I want to monitor my filedescriptors. I want to know how many files are open in my server.

Can I know this with this command?

Re: sar command

Devesh Pant_1 — Tue, 15 Mar 2005 14:02:37 GMT

have you looke into lsof ?

http://www.cert.org/security-improvement/implementations/i042.05.html
Running lsof with no options will likely generate a huge list of open files (depending on your system) that is too big to be useful. However, this list could help you understand what is "normal" behavior for a given system. In the day-to-day use of lsof as an intrusion detection tool, there are two options that are initially most useful; the -p and -i options. The -p option lists open files for a given process id. For example, to view init associated processes, you enter: lsof -p 1. The capital -P option instructs the tool to not convert raw port numbers to the names of the programs that they are normally associated with. The -i option allows one to just examine the Internet processes. With this option, one can examine the open ports waiting (listening) for connection attempts. This aids in detecting signs of intrusion and points out unnecessary open services.

thanks
Devesh

Re: sar command

Kenneth Platz — Tue, 15 Mar 2005 17:13:43 GMT

The file-sz column shows the number of open file descriptors compared to the maximum number of open file descriptors (system-wide, as defined by the "nfile" kernel parameter).

In this case, you are between 4014 and 4029 open file descriptors over the course of the execution of this sar.