#!/bin/bash

# Set the maximum load threshold
MAX_LOAD=10

# Loop through all SAR log files (sa01 to sa31)
for day in {01..31}; do
    # Construct the SAR log file path
    SAR_FILE="/var/log/sa/sa$day"

    # Check if the SAR log file exists
    if [[ -f "$SAR_FILE" ]]; then
        echo "Checking $SAR_FILE..."

        # Extract the load average data using sar -q and check if it exceeds MAX_LOAD
        sar -q -f "$SAR_FILE" | awk -v max_load="$MAX_LOAD" -v day="$day" '
        # Skip headers and process only data lines
        /^[0-9][0-9]:[0-9][0-9]:[0-9][0-9] (AM|PM)/ {
            # Combine the timestamp (columns 1 and 2)
            timestamp = $1 " " $2;

            # Extract ldavg-1 (column 6), ldavg-5 (column 7), and ldavg-15 (column 8)
            ldavg1 = $6 + 0;  # Force numeric conversion
            ldavg5 = $7 + 0;  # Force numeric conversion
            ldavg15 = $8 + 0; # Force numeric conversion

            # Check if any of the load averages exceed the threshold
            if (ldavg1 > max_load || ldavg5 > max_load || ldavg15 > max_load) {
                printf "On day %02d, load exceeded %d at: %s Load averages: %.2f %.2f %.2f\n", day, max_load, timestamp, ldavg1, ldavg5, ldavg15;
            }
        }'
    else
        echo "File $SAR_FILE does not exist."
    fi
done