Sar command usage with examples in Linux

System Activity Reporter (SAR) is one of the important tool to monitor Linux servers. This command will helps system administrators to check the server resources status at different time frames. By using this command we can analyse the history of different resource usages. We already discussed the “Load and Memory monitoring using SAR“. In this article I’m explaining the installation steps and the commandline usages.

Sar is part of the sysstat package. According to the package, it includes the following system performance tools:

>> sar: collects and reports system activity information;
>> iostat: reports CPU utilization and disk I/O statistics;
>> mpstat: reports global and per-processor statistics;
>> pidstat: reports statistics for Linux tasks (processes);
>> sadf: displays data collected by sar in various formats.

How to install and configure SAR (Systat) on Linux server?

The installation steps are quite simple. You can use the package managers YUM, APT-GET etc to install Systat.

Installation steps:

>> SSH into server as root.
>> Execute the following command:

yum install sysstat

For Ubuntu use the following command:

sudo apt-get install sysstat

To check the installed version you can use the switch “V” along with the sar command. Please see the sample output:

[root@vps ~]# sar -V
sysstat version 9.0.4
(C) Sebastien Godard (sysstat  orange.fr)

How to check the SAR is working properly?

After the installation, you have to check if it’s working properly or not. You can simply check the functionality by using the following command:

sar 1 2

It’ll display server resources two times with one second interval.

sar12

Different switches available with SAR and its usages

1, Monitoring load average (sar -q)

We can use the switch “q” to obtain load average details. This will report the run queue status (runq-sz), task list status (plist-sz) and the load averages of last 1 minute, 5 minutes, and 15 minutes.

Different usages

sar -q (Lists the details from the staring of this day)
sar -q 1 2 (Lists load average details two times with an interval of on second)
sar -q -f /var/log/sa/sa23 (Fetch load average details of previous dates. Those files are located under “/var/log/sa/”).

Example

[root@vps ~]# sar -q 1 2
Linux 2.6.32-042stab088.4 (vps.crybit.com)      03/19/15        _x86_64_        (8 CPU)

16:16:25      runq-sz  plist-sz   ldavg-1   ldavg-5  ldavg-15
16:16:26            0        34      0.00      0.00      0.00
16:16:27            0        34      0.00      0.00      0.00
Average:            0        34      0.00      0.00      0.00

>> runq-sz : Run queue length (number of tasks waiting for run time).
>> plist-sz : Number of tasks in the task list.
>> ldavg-1 : Load avg past 1 minute.
>> ldavg-5 : Load avg past 5 minute.
>> ldavg-15 : Load avg past 15 minute.

If you see the option “blocked” in sar output, that represents the tasks currently blocked and waiting for I/O operation to complete.

2, Monitoring memory details (sar -r)

The switch “-r” will help you to analyse memory usage by using sar command. The command usages are similar to previous. Different usages are listed below:

sar -r (Lists the details from the staring of this day)
sar -r 1 2 (Lists memory usage details two times with an interval of on second)
sar -r -f /var/log/sa/sa23 (Fetch memory usage details of previous dates. Those files are located under “/var/log/sa/”).

Example

[root@vps ~]# sar -r 1 2
Linux 2.6.32-042stab088.4 (vps.crybit.com)      03/19/15        _x86_64_        (8 CPU)

16:45:59    kbmemfree kbmemused  %memused kbbuffers  kbcached  kbcommit   %commit
16:46:00       109548    414740     79.11         0    300664         0      0.00
16:46:01       109544    414744     79.11         0    300664         0      0.00
Average:       109546    414742     79.11         0    300664         0      0.00

Field descriptions

>> kbmemfree : Amount of free memory available in kilobytes.
>> kbmemused : Amount of used memory in kilobytes. This does not take into account memory used by the kernel itself.
>> %memused : Percentage of used memory.
>> kbbuffers : Amount of memory used as buffers by the kernel in kilobytes.
>> kbcached : Amount of memory used to cache data by the kernel in kilobytes.
>> kbcommit : Amount of memory in kilobytes needed for current workload. This is an estimate of how much RAM/swap is needed to guarantee that there never is out of memory.
>> %commit : Percentage of memory needed for current workload in relation to the total amount of memory (RAM+swap). This number may be greater than 100% because the kernel usually overcommits memory.

3, Sar command to check the swap usage

Here we can use the switch “S” to find the swap usage. The procedures are same as above.

sar -S
sar -S 1 3
sar -S -f /var/log/sa/sa23

Example

[root@vps ~]# sar -S 1 3
Linux 2.6.32-042stab088.4 (vps.crybit.com)      03/19/15        _x86_64_        (8 CPU)

18:33:19    kbswpfree kbswpused  %swpused  kbswpcad   %swpcad
18:33:20            0         0      0.00         0      0.00
18:33:21            0         0      0.00         0      0.00
18:33:22            0         0      0.00         0      0.00
Average:            0         0      0.00         0      0.00

>> kbswpfree : Amount of free swap space in kilobytes.
>> kbswpused : Amount of used swap space in kilobytes.
>> %swpused : Percentage of used swap space.
>> kbswpcad : Amount of cached swap memory in kilobytes. This is memory that once was swapped out, is swapped back in but still also is in the swap area.
>> %swpcad : Percentage of cached swap memory in relation to the amount of used swap space.

Switches to display report in between a time frame (Specified start time and end time)

The switches “s” and “e” are using to define the time frame for the sar report. See the sample reports:

4, Start time (s) and End time (e)

Example : Sar report with start time 16:00:00

[root@vps ~]# sar -s 16:00:00
Linux 2.6.32-042stab088.4 (vps.crybit.com)      03/19/15        _x86_64_        (8 CPU)

16:00:01        CPU     %user     %nice   %system   %iowait    %steal     %idle
16:10:01        all      0.02      0.00      0.01      0.00      0.00     99.97
16:20:01        all      0.04      0.00      0.01      0.00      0.00     99.95
16:30:01        all      0.03      0.00      0.01      0.00      0.00     99.97
16:40:01        all      0.02      0.00      0.01      0.00      0.00     99.98
16:50:01        all      0.03      0.00      0.01      0.00      0.00     99.97
17:00:01        all      0.02      0.00      0.01      0.00      0.00     99.97
17:10:01        all      0.02      0.00      0.01      0.00      0.00     99.97
17:20:01        all      0.08      0.00      0.02      0.00      0.00     99.91

End time (e)

Example : Sar report upto 12:00:01

[root@vps ~]# sar -e 12:00:01
Linux 2.6.32-042stab088.4 (vps.crybit.com)      03/19/15        _x86_64_        (8 CPU)

11:00:01        CPU     %user     %nice   %system   %iowait    %steal     %idle
11:10:01        all      0.05      0.00      0.01      0.00      0.00     99.94
11:20:01        all      0.25      0.00      0.06      0.00      0.00     99.69
11:30:02        all      0.07      0.00      0.02      0.00      0.00     99.91
11:40:01        all      0.02      0.00      0.01      0.00      0.00     99.97
11:50:01        all      0.02      0.00      0.01      0.00      0.00     99.97
12:00:01        all      0.02      0.00      0.01      0.00      0.00     99.98
Average:        all      0.07      0.00      0.02      0.00      0.00     99.91

You can also use “s” and “e” option combined to list details in between a time frame.

For example

sar -s 16:00:00 -e 17:00:00

That’s it. A lot of other options are available with SAR which will add very soon… 🙂

Related

1, Load & Memory monitoring using SAR
2, Load monitoring in Linux servers – top, w and uptime commands’ usage for checking the load on server
3, 20+ Rsync command’s switches and common usages
4, What is Rsync over SSH? Command for Rsync over SSH?

Arunlal Ashok

Sr. Linux Server Administrator. I'm managing Linux servers since 2012. I started this blog to share and discuss my ideas. Check My Profile in uPwork (oDesk) and create a job, if you need any administration help. Thanks!!

You may also like...

2 Responses

  1. jishnu says:

    You saved my neck bro!!! I was searching for this “sar -s 16:00:00 -e 17:00:00” option!!! Thanks a lot <3

Leave a Reply

Your email address will not be published. Required fields are marked *