Process disk data from sar data collection

proc_sar_disk.awk

#!/usr/bin/awk -f

function mydtstamp(mydt) {
    split($1,tparts,":")
    switch($2){ 
        case "AM":
            if(tparts[1]==12)
                tparts[1]="00"
            break
        case "PM":
            if(tparts[1]<12)
                tparts[1]+=12
            break
    }
    return sprintf("%s %02d:%02d:00",mydate,tparts[1],tparts[2])
}

/DEV/ {
    printstat[myhost][mydate]++
    split($0,parts," ")
    for(i in parts) {
        if(parts[i]=="await")
          awaitpos=i;
        if(parts[i]=="avgrq-sz")
          rqsz=i
        if(parts[i]=="rd_sec/s")
          rdss=i
        if(parts[i]=="wr_sec/s")
          wrss=i
    }
    next
}

/^Average/ && printstat[myhost][mydate]==1 {
    printstat[myhost][mydate]++
    next
}

/^Linux / {
    mydate=$4
    myhost=$3
    gsub(/[^a-zA-Z0-9\-\_\.]/,"",myhost)
    MYHOSTS[myhost]=1
}

/^[0-9]*:[0-9]*:[0-9]* */ && printstat[myhost][mydate]==1 {
    if($2~/[AP]M/) {
        dt=mydtstamp()
        mydev=myhost"-"$3
    } else {
        dt=mydate" "$1
        gsub(/:[0-9][0-9]$/,":00",dt)
        mydev=myhost"-"$2
    }
    split($0,a," ")
    DEVSTAT[dt][mydev]["await"]=a[awaitpos]
    DEVSTAT[dt][mydev]["util"]=$NF
    DEVSTAT[dt][mydev]["rdsec"]=a[rdss]
    DEVSTAT[dt][mydev]["wrsec"]=a[wrss]
    DEVSTAT[dt][mydev]["avgrqsz"]=a[rqsz]
    DEVSTAT[dt][mydev]["awsum"]+=a[awaitpos]
    DEVSTAT[dt][mydev]["utsum"]+=$NF
    DEVICES[mydev]=1
}

END {
    printf("time")>>"await.csv"
    printf("time")>>"util.csv"
    printf("time")>>"wrsec.csv"
    printf("time")>>"rdsec.csv"
    printf("time")>>"avgrqsz.csv"

    n=asorti(DEVICES,DEVS)
    for(i=1;i<=n;i++) {
        printf(","DEVS[i]) >> "await.csv"
        printf(","DEVS[i]) >> "util.csv"
        printf(","DEVS[i]) >> "wrsec.csv"
        printf(","DEVS[i]) >> "rdsec.csv"
        printf(","DEVS[i]) >> "avgrqsz.csv"
    }
    print "" >> "await.csv"
    print "" >> "util.csv"
    print "" >> "wrsec.csv"
    print "" >> "rdsec.csv"
    print "" >> "avgrqsz.csv"
    dtcount=asorti(DEVSTAT,DTSTAMPS)
    for(i=1;i<=dtcount;i++) {
        mydt=DTSTAMPS[i]
        printf(mydt)>>"await.csv"
        printf(mydt)>>"util.csv"
        printf(mydt)>>"wrsec.csv"
        printf(mydt)>>"rdsec.csv"
        printf(mydt)>>"avgrqsz.csv"
        for(j=1;j<=n;j++) {
            printf(","DEVSTAT[mydt][DEVS[j]]["await"])>>"await.csv"
            printf(","DEVSTAT[mydt][DEVS[j]]["util"])>>"util.csv"
            printf(","DEVSTAT[mydt][DEVS[j]]["wrsec"])>>"wrsec.csv"
            printf(","DEVSTAT[mydt][DEVS[j]]["rdsec"])>>"rdsec.csv"
            printf(","DEVSTAT[mydt][DEVS[j]]["avgrqsz"])>>"avgrqsz.csv"
        }
        print "" >>"await.csv"
        print "" >>"util.csv"
        print "" >>"wrsec.csv"
        print "" >>"rdsec.csv"
        print "" >>"avgrqsz.csv"
    }
}

cat sar21 | ./proc_sar_disk.awk

-- This will produce 5 output csv files. await, util, wrsec, rdsec, and avgrqsz
-- You can cat multiple sar files at the same time, and the output will include time stamped data covering the entire period, and also multiple hosts can be included.