sar Command
Collect, report, and save system activity information for performance monitoring and analysis.
Syntax
sar [OPTIONS] [INTERVAL [COUNT]]
sar [OPTIONS] -f [FILENAME]
The sar (System Activity Reporter) command is part of the sysstat package and provides comprehensive system performance monitoring capabilities.
Common Options
| Option | Description |
|---|---|
-u |
Display CPU utilization statistics |
-r |
Display memory utilization statistics |
-d |
Display block device activity |
-n DEV |
Display network device statistics |
-b |
Display I/O and transfer rate statistics |
-q |
Display queue length and load averages |
-w |
Display task creation and system switching |
-f |
Extract records from file |
-s TIME |
Set starting time for report |
-e TIME |
Set ending time for report |
Basic Examples
CPU monitoring
# Display current CPU statistics
sar -u
# Monitor CPU every 2 seconds, 5 times
sar -u 2 5
# Monitor CPU continuously every second
sar -u 1
# Monitor all CPUs individually
sar -P ALL 1 5
Monitor CPU utilization and performance
Memory monitoring
# Display memory utilization
sar -r
# Monitor memory every 5 seconds
sar -r 5 10
# Display swap space utilization
sar -S
# Monitor memory and swap together
sar -r -S 2 5
Monitor memory and swap usage
Disk I/O monitoring
# Display block device activity
sar -d
# Monitor disk I/O every 3 seconds
sar -d 3 10
# Display I/O transfer rates
sar -b
# Monitor specific device
sar -d -p 2 5
Monitor disk activity and I/O performance
Advanced Monitoring
Network monitoring
# Display network device statistics
sar -n DEV
# Monitor network interfaces every 2 seconds
sar -n DEV 2 10
# Display network error statistics
sar -n EDEV
# Monitor TCP statistics
sar -n TCP
# Display socket statistics
sar -n SOCK
# All network statistics
sar -n ALL 5 5
Monitor network interface activity and statistics
System load and processes
# Display queue length and load averages
sar -q
# Monitor system load every minute
sar -q 60 10
# Display task creation and switching
sar -w
# Monitor process creation
sar -w 5 12
# Display paging statistics
sar -B
Monitor system load, processes, and paging activity
Comprehensive monitoring
# Monitor multiple metrics together
sar -u -r -d -n DEV 5 10
# All system activity
sar -A 10 6
# Custom monitoring script
sar -u -r -q -d 30 > system_report.txt &
# Monitor with timestamps
sar -u -t 5 20
Comprehensive system monitoring with multiple metrics
Historical Data Analysis
Reading historical data
# Display data from today's log file
sar -u -f /var/log/sysstat/sa$(date +%d)
# Display yesterday's CPU data
sar -u -f /var/log/sysstat/sa$(date -d yesterday +%d)
# Display specific day's data
sar -u -f /var/log/sysstat/sa15
# Display all available historical data
sar -u -f /var/log/sysstat/sa*
Analyze historical system performance data
Time-based filtering
# Display data for specific time range
sar -u -s 09:00:00 -e 17:00:00 -f /var/log/sysstat/sa15
# Morning hours analysis
sar -r -s 08:00:00 -e 12:00:00
# Peak hours monitoring
sar -d -s 14:00:00 -e 18:00:00 -f /var/log/sysstat/sa$(date +%d)
# Night time analysis
sar -u -s 22:00:00 -e 06:00:00 -f /var/log/sysstat/sa15
Filter historical data by time ranges
Practical Examples
Performance troubleshooting
# Identify CPU bottlenecks
sar -u 1 60 | awk '$3 > 80 {print "High CPU at", $1}'
# Monitor memory pressure
sar -r 5 20 | awk '$4 < 10 {print "Low memory at", $1}'
# Check disk I/O issues
sar -d 2 30 | awk '$4 > 100 {print "High I/O on", $2, "at", $1}'
# Network utilization analysis
sar -n DEV 5 10 | grep eth0
Use sar for performance troubleshooting and bottleneck identification
Capacity planning
# Weekly CPU trend analysis
for day in {01..07}; do
echo "Day $day:"
sar -u -f /var/log/sysstat/sa$day | tail -1
done
# Peak memory usage over time
sar -r -f /var/log/sysstat/sa* | awk '{if($4
Analyze trends for capacity planning and resource allocation
Automated monitoring
#!/bin/bash
# Automated system monitoring script
DATE=$(date +%Y%m%d)
REPORT_DIR="/var/log/performance"
# Create daily performance report
{
echo "System Performance Report - $(date)"
echo "=================================="
echo
echo "CPU Utilization Summary:"
sar -u | tail -1
echo
echo "Memory Usage Summary:"
sar -r | tail -1
echo
echo "Disk I/O Summary:"
sar -d | tail -1
echo
echo "Network Activity Summary:"
sar -n DEV | grep -E "(eth0|wlan0)" | tail -2
} > "$REPORT_DIR/performance_$DATE.txt"
# Email report if issues detected
if sar -u 1 1 | awk 'NR==4 {if($5 < 20) exit 1}'; then
mail -s "High CPU Alert" [email protected] < "$REPORT_DIR/performance_$DATE.txt"
fi
Automate performance monitoring and alerting
Data Collection Setup
Configuring sysstat
# Install sysstat package
# Ubuntu/Debian
sudo apt update && sudo apt install sysstat
# RHEL/CentOS/Fedora
sudo yum install sysstat
# or
sudo dnf install sysstat
# Enable data collection
sudo systemctl enable sysstat
sudo systemctl start sysstat
# Check service status
sudo systemctl status sysstat
Install and configure sysstat for automatic data collection
Customizing data collection
# Edit sysstat configuration
sudo nano /etc/sysstat/sysstat
# Key settings:
# HISTORY=28 # Keep 28 days of data
# COMPRESSAFTER=10 # Compress files after 10 days
# SADC_OPTIONS="" # Additional sadc options
# Modify collection interval in crontab
sudo crontab -e
# Add or modify:
# */5 * * * * /usr/lib/sysstat/sa1 1 1
# Manual data collection
sudo /usr/lib/sysstat/sa1 1 1
# Generate daily summary
sudo /usr/lib/sysstat/sa2
Customize data collection intervals and retention
Output Formats and Analysis
Understanding sar output
CPU Statistics (%usr, %nice, %sys, %iowait, %idle)
- %usr - User space CPU usage
- %nice - Nice priority processes CPU usage
- %sys - System/kernel space CPU usage
- %iowait - CPU waiting for I/O operations
- %idle - CPU idle time
Exporting and formatting data
# Export to CSV format
sar -u 1 10 | awk 'NR>3 {print $1","$3","$4","$5","$6","$7}' > cpu_data.csv
# Generate HTML report
sar -u -f /var/log/sysstat/sa$(date +%d) | awk '
BEGIN {print ""}
NR>3 {print "
"}' > report.html
# JSON format output
sar -u 1 3 | awk 'NR>3 {printf "{\"time\":\"%s\",\"user\":%s,\"system\":%s}\n", $1, $3, $5}'
# Create graphs with gnuplot
sar -u 1 60 | awk 'NR>3 {print NR-3, $3}' | gnuplot -e "plot '-' with lines; pause -1"
| "$1" | "$3" | "$4" |
Export and format sar data for analysis and reporting
Best Practices
Monitoring Best Practices
- Use appropriate intervals - shorter for troubleshooting, longer for trends
- Monitor multiple metrics together for comprehensive analysis
- Set up automated data collection with sysstat service
- Archive historical data for long-term trend analysis
- Create alerts based on threshold values
- Document baseline performance metrics
Common Issues
- Missing data files - Ensure sysstat service is running
- Permission errors - Check access to /var/log/sysstat/
- High overhead - Avoid very short intervals in production
- Disk space - Monitor log file sizes and implement rotation