I agree with the previous reply about running collectl - probably because I wrote it. 9-)
The important thing to remember if you run collectl or even sar is to have a farily high monitoring frequency and I know most sar users monitor once every 10 minutes. By default collectl monitors once every 10 seconds, but even at that frequency it typically uses <0.1% of the cpu.
Once you've collected a pile of data with it you can then play it back and look at a variety of data in a variety of formats showing most of the types of things sar shows and then some. The key things I'd look for are system resources that are going up in consumption as well as what was going on at the time of the 'lock up', assuming you know the approximate time.
One resource people often miss (probably because there aren't any other utilities I know of that will log their usage) is 'slabs'. Collectl will show you the amount of memory allocated to slabs when you show memory usage but if in fact you think you are seeing an issue, you can also look at changes over time to individual slabs. Since slab monitoring (and process monitoring too for that matter) are more expensive to monitor than the other types of data, those subsystems are monitored once a minute in order to stay within that <0.1% overhead window.
Just keep in mind that by default collectl will write its data to a log in /var/log/collect, creating a new log every day and retaining 7 previous ones. If you do need to keep more, you can modify the number in /etc/collectl.conf.
check it out at
http://collectl.sourceforge.net/ and enjoy
-mark
