This README is most readable with a WIDE screen... VERSION: 1.0 CONTACT FOR QUESTIONS: Troy Campbell: tlc@studioc.org BRIEF DESCRIPTION: "nsar" gathers network statistics about network interfaces on the server, and is a complement to the "sar" command which gathers other server statistics. INSTALLATION INFORMATION: Run "installnsar" to install. Typical install would be something like: % tar -xf nsar.tar && nsar/installnsar The installnsar script is designed so that by simply hitting the RETURN key four or five times you can install a reasonable default which can be updated later by simply rerunning the script. Then simply wait a few minutes and run "nsar" to see captured information. If installnsar is run as root it will ask if you want to install as the "sys" user (which is what "sar" also runs as) and if so it will put it in system directories otherwise it will install under the current directory and will try to add the "hostname" to base directory path at install time so that you can log into various machines and reinstall from the same install directory assuming it is some type of a clustered filesystem e.g., NFS. NA1 UTILITY AND SPACE USAGE FOR LOG FILES: "na1" is a utility program that logs to the current days log file, removes out of date files and compresses previous days files. It is installed in cron by the installnsar script. Since the previous days log files are compressed the amount of space needed is very small however the more interfaces on a machine requires more space. For example using 5 minute intervals the current day log file is around 100K and the previous days are less than 10K (using bzip2 for compression e.g., Solaris 8 and above). This means that for 30 days of datafiles it requires less than one half of one megabyte of disk space. If you have multiple interfaces it will take more however this should not be a big issue unless you are really short on space. DEFINITION OF COLUMNS WHEN USING NSAR COMMAND: Column Printed by option Description ------ ----------------- ----------- time always time metrics were captured. Two time intervals minimum are required for a delta time iface always network interface in% default -u -a -A input utilization as percentage of total bandwidth of interface out% default -u -a -A output utilization as percentage of total bandwidth of interface tot% default -u -a -A total utilization (input + output) as percentage of total bandwidth of interface idle% default -u -a -A idle percentage of total bandwidth of interface iKbyte -k -a -A input kilobytes per time interval, or per second if -s option is specified oKbyte -k -a -A output kilobytes per time interval, or per second if -s option is specified tKbyte -k -a -A total kilobytes per time interval, or per second if -s option is specified ipkt -p -a -A input packets per time interval, or per second if -s option is specified opkt -p -a -A output packets per time interval, or per second if -s option is specified tpkt -p -a -A total packets per time interval, or per second if -s option is specified mcast ipkt -p -a -A multicast input packets per time interval, or per second if -s option is specified mcast opkt -p -a -A multicast packets per time interval, or per second if -s option is specified bcast ipkt -p -a -A broadcast input packets per time interval, or per second if -s option is specified bcast opkt -p -a -A broadcast input packets per time interval, or per second if -s option is specified ierr -e -a -A total input errors per time interval, or per second if -s option is specified oerr -e -a -A total output errors per time interval, or per second if -s option is specified coll -e -a -A total collisions per time interval, or per second if -s option is specified ip address -d -a -A ip address of interface (interface "details" that don't change very often) ethernet address -d -A ethernet address of interface mtu -d -A maximum transmission unit of interface netmask -d -A netmask of interface speed -d -A speed (in megabits) of interface per second EXAMPLES: % nsar time iface in% out% tot% idle% 00:05 ce0 0 0 0 100 00:10 ce0 0 0 0 100 00:15 ce0 0 0 0 100 00:20 ce0 0 0 0 100 00:25 ce0 0 0 0 100 00:30 ce0 0 0 0 100 00:35 ce0 0 0 0 100 00:40 ce0 0 0 0 100 00:45 ce0 0 0 0 100 00:50 ce0 0 0 0 100 00:55 ce0 0 0 0 100 01:00 ce0 0 0 0 100 01:05 ce0 3 3 6 94 01:10 ce0 7 7 14 86 01:15 ce0 7 7 14 86 01:20 ce0 7 7 14 86 01:25 ce0 7 7 14 86 01:30 ce0 7 7 14 86 01:35 ce0 4 4 8 92 01:40 ce0 3 3 6 94 01:45 ce0 1 1 2 98 01:50 ce0 1 1 2 98 The above shows an example where the data is being collected in five minute intervals. At first the network interface is 100% idle. Then at 01:05 it starts using 6% (3% input, 3% output) of the total bandwidth of the network. Note that because nsar requires two time segments to measure a change the first time interval (in this case 00:00) is "absorbed". Note "sar" does the same thing. Also the last entry is 23:55 because that is when the last time "na1", the logger program, runs. If you want to get metrics at closer to 00:00 you could adjust the cron entry for "na1" to other minute offsets than the defaults provided by the installer, or select 1 minute cron time intervals using "installnsar". % nsar -ud time iface in% out% tot% idle% ip address ethernet address mtu netmask speed 00:05 ce0 0 0 0 100 192.81.145.129 8:0:20:e4:5a:82 1500 ffffff00 1000 00:10 ce0 0 0 0 100 199.81.145.129 8:0:20:e4:5a:82 1500 ffffff00 1000 The above shows interface utilization and interface "details" (which usually do not change). For example we see the ip address, ethernet address, maximum transmission unit, netmask and speed of the interface in Megabits per second. The above is a "Gigabit" interface. % nsar -p mcast mcast mcast bcast bcast bcast time iface ipkt opkt tpkt ipkt opkt tpkt ipkt opkt tpkt 00:05 ce0 37726 29547 67273 5 0 5 14339 0 14339 00:10 ce0 31099 18976 50075 5 0 5 14250 0 14250 The above show packet information i.e., the input packets, output packets and total packets for these time intervals. It also show the multicast input packets (mcast ipkt)...broadcast total packets (bcast tpkt) for these time intervals. % nsar -ps mcast mcast mcast bcast bcast bcast time iface ipkt/s opkt/s tpkt/s ipkt/s opkt/s tpkt/s ipkt/s opkt/s tpkt/s 00:05 ce0 125 98 224 0 0 0 47 0 47 00:10 ce0 103 63 166 0 0 0 47 0 47 The above shows the same information as the previous example except it show the totals in "per second" instead of "per 5 minute time intervals". % nsar -psk time iface iKbyte/s oKbyte/s tKbyte/s ipkt/s opkt/s tpkt/s ipkt/s opkt/s tpkt/s ipkt/s opkt/s tpkt/s 00:05 ce0 15 72 87 125 98 224 0 0 0 47 0 47 00:10 ce0 13 28 41 103 63 166 0 0 0 47 0 47 The above shows the same information as the previous example except it also add the input, output and total K bytes per second columns. If the -s option wasn't used it would show the input, output, and total K bytes per time interval. To view following without line wrap you may have to go to a 9.5 font if using dtterm (Options -> Font Size -> 9.5) % nsar -a mcast mcast mcast bcast bcast bcast time iface in% out% tot% idle% iKbyte oKbyte tKbyte ipkt opkt tpkt ipkt opkt tpkt ipkt opkt tpkt ierr oerr coll 00:05 ce0 0 0 0 100 4643 21606 26250 37726 29547 67273 5 0 5 14339 0 14339 0 0 0 00:10 ce0 0 0 0 100 4089 8401 12490 31099 18976 50075 5 0 5 14250 0 14250 0 0 0 00:15 ce0 0 0 0 100 5431 54526 59958 50690 52994 103684 5 0 5 14345 2 14347 0 0 0 00:20 ce0 0 0 0 100 5561 58955 64517 52528 55954 108482 5 0 5 14723 3 14726 0 0 0 00:25 ce0 0 0 0 100 5570 60282 65853 52717 56928 109645 5 0 5 14303 2 14305 0 0 0 00:30 ce0 0 0 0 100 4184 9185 13370 32085 20088 52173 5 0 5 14417 0 14417 0 0 0 00:35 ce0 0 0 0 100 4186 8632 12819 32423 20219 52642 5 0 5 14390 2 14392 0 0 0 To view following you may have to go to a 6.5 font if using dtterm (Options -> Font Size -> 9.5) % nsar -A mcast mcast mcast bcast bcast bcast time iface in% out% tot% idle% iKbyte oKbyte tKbyte ipkt opkt tpkt ipkt opkt tpkt ipkt opkt tpkt ip address ethernet address mtu netmask speed ierr oerr coll 00:05 ce0 0 0 0 100 4643 21606 26250 37726 29547 67273 5 0 5 14339 0 14339 199.81.145.129 8:0:20:e4:7a:82 1500 ffffff00 1000 0 0 0 00:10 ce0 0 0 0 100 4089 8401 12490 31099 18976 50075 5 0 5 14250 0 14250 199.81.145.129 8:0:20:e4:7a:82 1500 ffffff00 1000 0 0 0 00:15 ce0 0 0 0 100 5431 54526 59958 50690 52994 103684 5 0 5 14345 2 14347 199.81.145.129 8:0:20:e4:7a:82 1500 ffffff00 1000 0 0 0 00:20 ce0 0 0 0 100 5561 58955 64517 52528 55954 108482 5 0 5 14723 3 14726 199.81.145.129 8:0:20:e4:7a:82 1500 ffffff00 1000 0 0 0 00:25 ce0 0 0 0 100 5570 60282 65853 52717 56928 109645 5 0 5 14303 2 14305 199.81.145.129 8:0:20:e4:7a:82 1500 ffffff00 1000 0 0 0 00:30 ce0 0 0 0 100 4184 9185 13370 32085 20088 52173 5 0 5 14417 0 14417 199.81.145.129 8:0:20:e4:7a:82 1500 ffffff00 1000 0 0 0 00:35 ce0 0 0 0 100 4186 8632 12819 32423 20219 52642 5 0 5 14390 2 14392 199.81.145.129 8:0:20:e4:7a:82 1500 ffffff00 1000 0 0 0 The following shows the same information except in per second instead of per interval values (also a good eye test): % nsar -As mcast mcast mcast bcast bcast bcast time iface in% out% tot% idle% iKbyte/s oKbyte/s tKbyte/s ipkt/s opkt/s tpkt/s ipkt/s opkt/s tpkt/s ipkt/s opkt/s tpkt/s ip address ethernet address mtu netmask speed ierr/s oerr/s coll/s 00:05 ce0 0 0 0 100 15 72 87 125 98 224 0 0 0 47 0 47 199.81.145.129 8:0:20:e4:7a:82 1500 ffffff00 1000 0 0 0 00:10 ce0 0 0 0 100 13 28 41 103 63 166 0 0 0 47 0 47 199.81.145.129 8:0:20:e4:7a:82 1500 ffffff00 1000 0 0 0 00:15 ce0 0 0 0 100 18 181 199 168 176 345 0 0 0 47 0 47 199.81.145.129 8:0:20:e4:7a:82 1500 ffffff00 1000 0 0 0 00:20 ce0 0 0 0 100 18 196 215 175 186 361 0 0 0 49 0 49 199.81.145.129 8:0:20:e4:7a:82 1500 ffffff00 1000 0 0 0 00:25 ce0 0 0 0 100 18 200 219 175 189 365 0 0 0 47 0 47 199.81.145.129 8:0:20:e4:7a:82 1500 ffffff00 1000 0 0 0 00:30 ce0 0 0 0 100 13 30 44 106 66 173 0 0 0 48 0 48 199.81.145.129 8:0:20:e4:7a:82 1500 ffffff00 1000 0 0 0 00:35 ce0 0 0 0 100 13 28 42 108 67 175 0 0 0 47 0 47 199.81.145.129 8:0:20:e4:7a:82 1500 ffffff00 1000 0 0 0 % nsar -ups ce0 hme2 | sort | uniq mcast mcast mcast bcast bcast bcast time iface in% out% tot% idle% ipkt/s opkt/s tpkt/s ipkt/s opkt/s tpkt/s ipkt/s opkt/s tpkt/s 00:05 ce0 0 0 0 100 125 98 224 0 0 0 47 0 47 00:05 hme2 0 0 0 100 13 0 13 0 0 0 13 0 13 00:10 ce0 0 0 0 100 103 63 166 0 0 0 47 0 47 ...chopped some output here 15:35 hme2 0 0 0 100 12 0 12 0 0 0 12 0 12 15:40 ce0 0 0 0 100 407 352 759 0 0 0 84 0 84 15:40 hme2 0 0 0 100 12 0 12 0 0 0 12 0 12 Avg ce0 0 0 0 98 496 439 936 0 0 0 76 0 76 Avg hme2 0 0 0 99 12 0 12 0 0 0 12 0 12 The above example shows selecting two interfaces on the system and then sorts the output lines together by time. This might be useful for comparing load balancing on two interfaces that are trunking perhaps. Could also show IP failovers. Note where the headers and "Avg" lines appear..