sar serves to log and evaluate a variety of information regarding system activity. With performance problems, sar also permits retroactive analysis of the load values for various sub-systems (CPUs, memory, disks, interrupts, network interfaces and so forth) and limitation of problems in this manner.
sar is a component of sysstat. sar itself consists of the following components:
- sar(1) – displays the recorded data.
- sadc(8) – system activity data collector, which records the data regarding system activity in a binary format.
- sa1(8) – a BASH script used by sadc in background; called every ten minutes by cron (from /etc/cron.d/sysstat).
- sa2(8) – a BASH script used for writing the daily reports and called by cron once per day (from /etc/cron.d/sysstat).
- sadf(1) – displays the recorded data; in contrast with sar provides various formats (CSV, XML and so forth).
Development of the sysstat package (which contains sar among others) is ongoing. The following schema is used for the version numbers Sysstat Download Page
- Version numbers with x.0 each indicate a stable version
- Version numbers with x.1 each indicate a version in development
Newer versions generally provide additional features. The features of sar -x and sar -X were exported to a separate command as of version 7.1.6 (pidstat).Sysstat Change log up to Version 8.0.4, Sysstat Change log from Version 8.1.1
As noted, sar is a component of the sysstat package, which is already contained in numerous distribution files and can be easily installed, depending on the distribution file, either by
yum install sysstat or
apt-get install sysstat. Generally at the same time, the cron jobs will be created in /etc/cron.d/sysstat.
Functional Approach of Logging
sa1 and sa2 will store the recorded data in the directories, /var/log/sa/ (RHEL/CentOS) or /var/log/sysstat/ (Debian). The data will be retained for a week retroactively in the default configuration. This duration can be increased to 28 days (in /etc/sysconfig/sysstat under RHEL/CentOS or in /etc/sysstat/config under Debian 4.0 and /etc/sysstat/sysstat under Debian 5.0).
Activating sar Logging in Debian: To activate automatic logging under Debian, the “ENABLED” parameters must be set to “true” in the /etc/default/sysstat file. This parameter has been set to “false” by default.
Here is an example of this:
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30
Displaying the recorded data using sar
Limiting the Display Period
sar can display either the data for the current day (which does not require any special parameters) or the data for a specific day (such as with the
-f /var/log/sa/sa21 parameter).
The query period can be further limited by the following parameters:
-s [ hh:mm:ss ] – sets the starting time (such as
-s 07:30:00); if a specific time is not specified, 08:00:00 will be used as the default starting time.
-s [ hh:mm:ss ] – sets the ending time (such as
-s 19:30:00); if a specific time is not specified, 18:00:00 will be used as the default ending time.
Parameters for Various Sub-systems
Here are several examples for displaying various values (the values originated on a system using CentOS 4.7 with sysstat version 5.0.5).
Displaying the CPU Load: sar -P ALL
The values for all CPUs (
-P ALL) will be displayed starting from the 25th of the current month (
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24
Displaying the RAM Load: sar -r
The RAM values (
-r) for the current day will be displayed here. A value of approximately 100 for the percentage of memory used is thoroughly positive (if swapping is not required). See also the [[RAID Controller and Hard Disk Cache Settings#Operating System Cache|Operating System Caches section of the RAID Controller and Hard Disk Cache Settings article]].
1 2 3 4 5 6 7 8 9 10 11 12
Displaying the Load Average: sar -q
The average load values (
-q) for the current day will be displayed here.
1 2 3 4 5 6 7 8 9 10 11
Displaying the I/O Transfer Rate: sar -b
The I/O transfer rates (
-r) for the current day will be displayed here.
1 2 3 4 5 6 7 8 9 10 11
tps – Total number of transfers per second that were issued to physical devices. A transfer is an I/O request to a physical device. Multiple logical requests can be combined into a single I/O request to the device. A transfer is of indeterminate size
rtps – Total number of read requests per second issued to physical devices
wtps – Total number of write requests per second issued to physical devices
bread/s – Total amount of data read from the devices in blocks per second. Blocks are equivalent to sectors with 2.4 kernels and newer and therefore have a size of 512 bytes. With older kernels, a block is of indeterminate size.
bwrtn/s – Total amount of data written to devices in blocks per second.
Displaying the Network Statistics: sar -n DEV
The statistical network values (
-n) for the current day will be displayed here.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18
Displaying All Values
The collective values for all devices (CPU, RAM, etc.) can be displayed using
Tools for Visual Assessment
The following tools represent the values recorded by sar visually.
- sar2png – A Perl Script for creating PNG files from sar data, tested under GNU/Linux and Solaris 10
- For additional tools, see Sysstat FAQs Question 2.11. Do you know a tool which can graphically plot the data collected by sar?
Original source: Creating Collect and report Linux System Activity Information with sar
Author: Werner Fischer