Turn sysstat Data into JSON and CSV with sadf

sadf turns a sysstat binary file into JSON or semicolon-separated records, ready for a script or database import, without touching the source file. The examples use sadf from sysstat 12.6.1, installed here as package version 12.6.1-2. Allow about fifteen minutes.

• You need: a shell and a readable sysstat data file, normally under /var/log/sysstat.
• Privilege note: every command here only reads an existing file and writes to standard output; no elevated privileges are normally needed. Do not reach for sudo just because the data directory is owned by root, test whether your own account can read the chosen file first.

1. Confirm the installed command and data file

Check the executable and version before putting an export in a script:

$ command -v sadf
/usr/bin/sadf
$ sadf -V
sysstat version 12.6.1
(C) Sebastien Godard (sysstat <at> orange.fr)

On this host, the current daily file is /var/log/sysstat/sa26. Use the file for the date you actually need; the name itself is host-specific. The ordinary default is the most recent daily file in /var/log/sysstat, with names such as saDD or saYYYYMMDD. You can also pass a day offset such as -1 for yesterday.

$ test -r /var/log/sysstat/sa26 && echo readable
readable
$ sadf -H /var/log/sysstat/sa26 | head -n 8
System activity data file: /var/log/sysstat/sa26 (0x2175)
File created by sar/sadc from sysstat version 12.6.1
Genuine sa datafile: yes (0)
Host: Linux 6.8.0-139-generic server.example.com	09/26/26
File date: 2026-09-26

The header is useful for confirming the file date, host and creator version. If the file was made by an incompatible sar, stop there and select a compatible data file instead.

2. Export structured data as JSON

Use -j when a program needs named JSON structures. This example selects a short window to keep the terminal output manageable:

$ sadf -j -s 20:00:00 -e 20:10:00 /var/log/sysstat/sa26 > cpu-window.json
$ head -n 12 cpu-window.json
{"sysstat": {
	"hosts": [
		{
			"nodename": "server.example.com",
			"sysname": "Linux",
			"release": "6.8.0-139-generic",
			"machine": "x86_64",
			"number-of-cpus": 8,
			"file-date": "2026-09-26",

With no activity option, sadf selects CPU activity. The JSON carries the host metadata alongside the selected statistics. Validate the result with an installed JSON parser when your workflow has one:

$ jq empty cpu-window.json && echo valid-json
valid-json

jq is not part of sadf; use your application's own JSON parser if it is absent. An empty time window can still produce valid JSON with no matching records, so validity alone does not prove the requested interval had samples.

3. Export database-friendly records

Use -d for records separated by semicolons. Put the filename before the two dashes that introduce options meant for sar:

$ sadf -d -s 20:00:00 -e 20:10:00 /var/log/sysstat/sa26 -- -n DEV > network.csv
$ head -n 5 network.csv
# hostname;interval;timestamp;IFACE;rxpck/s;txpck/s;rxkB/s;txkB/s;rxcmp/s;txcmp/s;rxmcst/s;%ifutil

Despite the filename above, this is not comma-separated CSV: -d uses semicolons. The first line is a header beginning with #, followed by the host, interval, timestamp and activity fields. Keep that delimiter in the importer, or pick a name such as network.sadf to make the format obvious to the next person.

The -- matters. Without it, a sar activity flag can be mistaken for a sadf option. -n DEV asks for network-device activity; it does not discover interfaces or change any networking.

4. Bound the records you select

The default time range surprises a lot of people: sadf starts at 08:00:00 and ends at 18:00:00 unless you give it -s and -e. Hours use 24-hour notation, so make the range explicit in any scheduled export:

$ sadf -d -s 00:00:00 -e 23:59:59 /var/log/sysstat/sa26 -- -n DEV 60 10

The positional values after the options are interval and count, so this asks for ten records at 60-second intervals from the selected file. Omitting count displays every matching record. These values select saved records; they never make sadf collect a fresh sample.

Use -P for processor-specific CPU data. Processor 0 is the first processor, while ALL reports each processor plus the global average:

$ sadf -p -P 0 -s 20:00:00 -e 20:10:00 /var/log/sysstat/sa26 | head -n 5

The -p format uses tab-separated fields suited to tools such as awk, and is often easier to process than the human-oriented output from sar.

5. Make timestamps unambiguous

By default, timestamps are UTC. Choose the representation deliberately once data starts crossing machines:

• -T displays timestamps in the current machine's local time.
• -t uses the original local time of the host that created the data file.
• -U emits UTC seconds since the Unix epoch.

For example, this keeps the record format database-friendly while choosing the creator's local time:

$ sadf -d -t -s 20:00:00 -e 20:10:00 /var/log/sysstat/sa26 -- -n DEV | head -n 3

Do not compare a local-time export against a UTC export as if their text timestamps were interchangeable. Record which option you used alongside the exported file, especially around daylight-saving changes.

6. Handle failures without changing the host

If sadf reports that it cannot open a file, check the path and read permission:

$ ls -l /var/log/sysstat/sa26
$ test -r /var/log/sysstat/sa26 && echo readable || echo not-readable

A non-zero result can also mean the file was made by an incompatible sysstat version, or that the requested options do not match the data present. Re-run sadf -H and test a short, known interval before touching permissions or copying files. Changing ownership or permissions on system activity logs is a security decision, outside the scope of this workflow.