[ Thanks to LinuxScribe
for this link. ]
“The four main components used in collection activities
are sar, sa1, sa2 and cron. Sar is the system activity reporter.
This tool will display interpreted results from the collected data.
Sar is ran interactively by an administrator via command line. When
a sar file is created, it is written into the /var/log/sa directory
and named sar##. The ## is a numerical value that represents the
day of the month (i.e. sa03 would be the third day of the month).
The numerical value changes accordingly without system
administrator intervention. There are many option flags to choose
from to display data in a sar file to view information about server
operations, such as cpu, network activity, NFS and sockets. These
options can be viewed by reviewing the man pages of sar.“Sa1 is the internal mechanism that performs the actual
statistical collection and writes the data to a binary file at
specified times. Information is culled from the /proc directory
where the Linux kernel writes and maintains pertinent data while
the operating system is running. Similar to sar, the binary file is
written into /var/log/sa and named sa##. Again, the ## represents
the day of the month (i.e. sar03 would be the third day of the
month). Once more, the numerical value changes accordingly without
system administrator intervention.”