what a weird hack! OS X comes with the sar command, which I found to be very helpful to look at what a machine is doing.
Just running
sar
Will look for todays performance. You have to collect it first. Traditionally this gets done via a cron job. OS X really likes to use launchd instead. But I need to get some work done, I don’t have the time to learn another propriatary solution for a very common problem: Running things periodically. So I stick with cron. Not sure why it is running on some of the systems and not on others. If you follow this make sure cron shows up in a ps ax | grep cron command. If it does then you could enable daily performance traces reportable by “sar” by adding
# run system activity accounting tool every 10 minutes
*/10 * * * * root /usr/lib/sa/sa1 1 1
# generate a daily summary of process accounting at 23:53
53 23 * * * root /usr/lib/sa/sa2 -A
to /etc/crontab. If cron runs then it will reread the file automatically. The remaining problem for me and under
OS X 10.4.3 was that sa1 overwrote instead of appended the performance data. A really terrible hack that fixed this was to change the lines in /usr/lib/sa/sa1 from
exec ${ENDIR}/sadc 1 1 ${DFILE}
to
exec ${ENDIR}/sadc 1 1 >>${DFILE}
This works, but generates error messages like:
sar: drivepath sync code error -4
when I retrieve the daily performance data.
This is good enough for me. All I am after is to find out what that 30TB Xsan has been doing.