Understanding the Linux sar Utility: An Essential Tool for System Performance Monitoring

In the realm of system administration, monitoring and optimising system performance is crucial for maintaining the health and efficiency of Linux servers. One powerful tool available for this purpose is sar, which stands for System Activity Report. This utility is part of the sysstat package, a suite of performance monitoring tools for Linux. In this article, we will delve into the functionality of sar, its key features, and how to effectively use it to keep your system running smoothly.

What is sar?

The sar utility is a command-line tool that collects, reports, and saves system activity information. It provides a wide range of performance metrics, including CPU usage, memory utilization, I/O statistics, and network activity. By analyzing this data, system administrators can gain valuable insights into system performance, identify potential bottlenecks, and troubleshoot issues before they become critical.

How to install sysstat on linux ?

sudo apt-get install sysstat

How to Configure systat for auto data collection

sudo systemctl enable sysstat

sudo systemctl start sysstat

How to set granularity for sysstat data collection

1. Edit the sysstat Configuration File:

set INTERVAL=10

collect data for every 10 sec

2. update the cron job

/10 * root /usr/lib/sysstat/sa1 1 1

change activity report schedule to 10 sec instead of 10 min

Here, 1 1 means sa1 collects data every 10 seconds. Adjust the */10 to your desired interval.

How to verify sysstat output

SAR command Practical Use :

CPU Usage :

SAR -P ALL

sar -P ALL 2 5 => Display All CPU usage each after 2 sec for 5 times

sar -P 2 => Display CPU usage for 1st CPU only

sar -P ALL -f sa23 => historical data for 23rd day for all CPU

sar -u 2 5

%user: Percentage of CPU utilization by user-level processes.

%nice: Percentage of CPU utilization by processes with a nice priority.

%system: Percentage of CPU utilization by system-level processes (kernel).

%iowait: Percentage of time CPU was waiting for I/O operations to complete.

%steal: Percentage of time spent in involuntary wait by the virtual CPU or hypervisor.

%idle: Percentage of time CPU was idle.

Swap Usage:

sar -S 2 10 => This command displays swap usage statistics (-S option) every 2 second for 10 iterations.

kbswpfree: Amount of free swap space available in kilobytes.

kbswpused: Amount of used swap space in kilobytes.

%swpused: Percentage of used swap space.

kbswpcad: Amount of cached swap space in kilobytes.

I/O Activity:

sar -b 1 10 => This command displays I/O activity statistics (-b option) every 2 second for 10 iterations.

tps: Transfers per second (I/O operations per second).

rtps: Read transfers per second.

wtps: Write transfers per second.

bread/s: Blocks read per second.

bwrtn/s: Blocks written per second.

Context Switches :

sar -w 2 10 => This command displays I/O activity statistics (-b option) every 2 second for 10 iterations.

if you want to check specific PID context switches then use pidstat

Network

sar -n DEV 1 10

rxpck/s: Packets received per second.

txpck/s: Packets transmitted per second.

rxkB/s: Kilobytes received per second.

txkB/s: Kilobytes transmitted per second.

rxcmp/s: Compressed packets received per second (if applicable).

txcmp/s: Compressed packets transmitted per second (if applicable).

rxmcst/s: Multicast packets received per second.

Memory

sar -r => one time showing current memory usage

sar -r 2 => real time memory usage interval of 2 sec for infinite count

sar -r 1 10 => real time memory usage with 2 sec interval for 10 count

kbmemfree: Free memory available in kilobytes.

kbmemused: Used memory in kilobytes.

%memused: Percentage of used memory.

kbbuffers: Memory used as buffers.

kbcached: Memory used as cache.

kbcommit: Total memory in use by the system (physical + swap).

%commit: Percentage of total memory used.

Specific time data extraction

CPU => sar -u -s 10:00:00 -e 11:00:00 -f /var/log/sa/saXX > CPU.csv

Memory => sar -r -s 10:00:00 -e 11:00:00 -f /var/log/sa/saXX > memory.csv

Network => sar -n DEV -s 10:00:00 -e 11:00:00 -f /var/log/sa/saXX > network.csv

I/O => sar -b -s 10:00:00 -e 11:00:00 -f /var/log/sa/saXX > IO.csv

swap => sar -S -s 10:00:00 -e 11:00:00 -f /var/log/sa/saXX > swap.csv

context switches => sar -w -s 10:00:00 -e 11:00:00 -f /var/log/sa/saXX > cs.csv

Checking Historical Data

CPU => sar -u -f /var/log/sa/saXX

Memory => sar -r -f /var/log/sa/saXX

Network => sar -n DEV -f /var/log/sa/saXX

I/O => sar -b -f /var/log/sa/saXX

Swap => sar -s -f /var/log/sa/saXX

context switches => sar -w -f /var/log/sa/saXX

Referene :

https://softpanorama.org/Admin/Monitoring/Sar/linux_implementation_of_sar.shtml#n20170403X_10_useful_sar_sysstat_examples_for_unix