How to view SYS SNAP logs from days before

[Jean-Francois Tellier]

Hi,

I installed Sys-snap.pl few days ago. It works weel.
I can start, stop, view TAR data logs from the same day.

[~] ./sys-snap.pl --loadavg 8:45 9:00

How to view logs, with verbose, from yesterday or days before?

I installed sysstat to be able to use SAR (looking server resources).
runq-sz plist-sz ldavg-1 ldavg-5 ldavg-15 blocked
Whit SRA I am able to look at logs from a selected day.
[~]# sar -q -f /var/log/sa/sa08 -s 23:20:00 (8th of the mouth)

But I want to see the verbose from the logs of theselected day.
Like in the command:
[~] /root/sys-snap.pl --print 08:45 09:00 --v

Best Regards,

Jean

 

[cPanelLauren]

The following instructions go over how to change the length of time syssnap keeps logs:

Find $root_dir/system-snapshot/$hour

Add the following line:
mkdir "$root_dir/system-snapshot/$loglevel";

and change the lines
mkdir "$root_dir/system-snapshot/$hour";
my $current_interval = "$hour/$min";

to
mkdir "$root_dir/system-snapshot/$loglevel/$hour";
my $current_interval = "$loglevel/$hour/$min";

 Because we use the localtime() function this gives us the following valid values:
$sec,$min,$hour,$mday,$mon,$year,$wday,$yday,$isdst


Without rewriting the documentation here http://perldoc.perl.org/functions/localtime.html the ones we would be most likely to use are $mday (day of the month) or $wday (day of the week)

 

[Jean-Francois Tellier]

Hi,
I'm not sure about where to find

$root_dir/system-snapshot/$hour

The only place where I see this line is around the line number 726:

# go to the next log file
mkdir "$root_dir/system-snapshot/$hour";
my $current_interval = "$hour/$min";

Do you mean to make the modifications like this?

# go to the next log file
mkdir "$root_dir/system-snapshot/$loglevel";
mkdir "$root_dir/system-snapshot/$loglevel/$hour";
my $current_interval = "$loglevel/$hour/$min";

You can find the script I use here:
CpanelInc/tech-SysSnapv2

Regards,

 

[cPanelLauren]

Hello,

I know the script you're using, the instructions to customize the script are something we have internall as it's not an officially supported script. The instructions I provided came directly from our internal wiki on modifying the logs.

The modification looks like what you've done in your response, when you restart SysSnap though can you confirm if it is modifying the logs as you've requested?

Thanks!

 

[Jean-Francois Tellier]

Hello,

The modification doesn't seems to works.
I got compilation error on stop and start.

[[email protected] ~]# perl /root/sys-snap.pl --start
Global symbol "$loglevel" requires explicit package name at /root/sys-snap.pl line 726.
Global symbol "$loglevel" requires explicit package name at /root/sys-snap.pl line 727.
Global symbol "$loglevel" requires explicit package name at /root/sys-snap.pl line 728.
Execution of /root/sys-snap.pl aborted due to compilation errors.

Here's what I changed

# go to the next log file
        mkdir "$root_dir/system-snapshot/$loglevel";
        mkdir "$root_dir/system-snapshot/$loglevel/$hour";
        my $current_interval = "$loglevel/$hour/$min";

 

[cPanelLauren]

Hi @Jean-Francois Tellier

I got some clarification on this today. $loglevel is meant to be whichever localtime variable you use as listed at the bottom of the customization instructions:

$sec,$min,$hour,$mday,$mon,$year,$wday,$yday,$isdst

We did the following and found that it worked:

726:    mkdir "$root_dir/system-snapshot/$mday";
727:        mkdir "$root_dir/system-snapshot/$mday/$hour";
728:        my $current_interval = "$mday/$hour/$min";

 

[Jean-Francois Tellier]

Great stop and start worked.

Can you tell me what is the command to retrieve by day?

We use this for the current day.

[~] /root/sys-snap.pl --print 08:45 08:49 --v

 

[cPanelLauren]

Hi @Jean-Francois Tellier

I've been discussing this with a colleague internally and he provided the following example:

You'd need to point it to the directory where that day's data is stored so if you wanted today (the 12th) between 2:25-2:35 to be displayed you'd do:

/root/sys-snap.pl --dir /root/system-snapshot/12/ --print 14:25 14:35

There are also quite a few other options you can use which are shown when using the --help flag with syssnap:

/root/sys-snap.pl --help
USAGE:
./sys-snap.pl [options]
    --start : Creates, disowns, and drops 'sys-snap.pl --start' process into the background
    --stop : stops sys-snap after confirming PID info
    --check : Checks if sys-snap is running
    --print <start-time end-time> : Where time HH:MM, prints basic usage by default
    --network <start-time end-time> : Prints IP connections durring time range
    --v | v : verbose output from --print
    --max-lines : max number of processes printed per mem/cpu section, default is 20
    --ll : line length, default is 145
    --no-cpu | --nc : skips CPU output
    --no-mem | --nm : skips memory output
    --loadavg <start-time end-time>: Where time HH:MM, prints load average for time period - default 10 min interval
    --dir : specifies a different sys-snap folder for --print and --loadavg

 

[Jean-Francois Tellier]

Thank you Lauren,

That will be a great tutorial for all!

Last question, not sure but, since the file sys-snap.pl has been changed, does it need new logs to search in?

Because I first tried to extract TAR file from last stop/start, but it give me nothing, logs from June 9th:

[~]# /root/sys-snap.pl --dir /root/system-snapshot/9/ --print 14:25 14:35

It only gave me data from the current day (12):

[~]# /root/sys-snap.pl --dir /root/system-snapshot/12/ --print 10:25 10:35 --v
user: nobody         
    cpu-score: 0.00     
        C: 0.00 proc: /usr/sbin/dnsmasq --conf-file=/var/lib/libvirt/dnsmasq/default.conf --leasefile-ro --dhcp-script=/usr/libexec/libvirt_leaseshelpe

Best Regards,

 

[cPanelLauren]

HI @Jean-Francois Tellier

I'm really glad you're finding sys-snap to be useful!

Right now, you'll need to allow time for the logs to populate, because you just changed it today you're only going to have data from the last 24 hours. You'll need to allow time for those to build up before you'll have more days.


Thanks!