process-sar-W

#!/usr/bin/perl -w
#
# 03:35:01 PM  pswpin/s pswpout/s
# 03:45:01 PM     61.31     52.17
# 03:55:01 PM     14.89      0.00
# 04:05:01 PM      9.87      0.00
# Average:       733.72    215.86
#
use strict;

my %collapsed;
my $headerlines = 3;

sub remember_stack {
	my ($stack, $count) = @_;
	$collapsed{$stack} += $count;
}

my $nr = 0;
my @stack;

my $snap = 5 ;
my $last = 0;
my $count = 0;
my $total_count = 0;
my $unfinished = 0 ;
my %completed ;
my $min_time = 0;
my $max_time = 0;
my $time = 0;
my @flags = qw ();
my $flag ;
while (<>) {
    chomp ;

    next if /Average/;

    ($time) = /^([\d\.]+)\s/ ;

    if ( /Flags \[([SFRP\.]+)\]/ ) {
        if ($1 eq 'S') {
            $flag = 'SYN';
        } elsif ($1 eq 'S.') {
            $flag = 'SYN-ACK';
        } elsif ($1 eq 'F.') {
            $flag = 'FIN';
        } else {
            next;
        }
    } else {
        die ("unexpected flag at $_");
    }

    # printf("debug: %d %s\n", $time, $flag);

    $time = int($time  / $snap) * $snap;

    if ($time > $max_time) {
        $max_time = $time;
    }
    if ($min_time == 0) {
        $min_time = $time;
    }
    $completed{$time}{$flag} ++  ;

=snip
    if ($time ne $last) {
        if ($last != 0) {
            printf("%d %d\n", $time, $count);

            $count = 1;

            $last = $time;
        } else {
            $last = $time;
            $count = 1;
        }
    } else {
        $count ++ ;
    }
=cut

}

printf("# parsed total %d syscalls, %d unfinished\n", $total_count, $unfinished);
printf("# time, date, %s\n", join(',',@flags));
for (my $idx = $min_time ; $idx < $max_time + $snap; $idx = $idx + $snap) {

    if (!exists($completed{$idx})) {
        printf("%s,%s,%s\n",
            $idx, scalar gmtime($idx),
            join(',', map { 0 } @flags));
        next;
    }

    printf("%d,%s", $idx, scalar gmtime($idx));
    foreach my $flag (@flags) {
        printf(",%d", $completed{$idx}{$flag} || 0);
    }
    printf("\n");

}