Sar command usage with examples in Linux

Sar is one of the smart command line utility in Linux. Also, System Activity Reporter (SAR) is one of the important tool to monitor Linux servers.This command will helps system administrators to check the server resources status at different time frames. By using this command we can analyse the history of different resource usages.

We already discussed the “Load and Memory monitoring using SAR“. In this article I’m explaining the installation steps and the command line usages.

Sar is part of the sysstat package. According to the package, it includes the following system performance tools:

>> sar: collects and reports system activity information;
>> iostat: reports CPU utilization and disk I/O statistics;
>> mpstat: reports global and per-processor statistics;
>> pidstat: reports statistics for Linux tasks (processes);
>> sadf: displays data collected by sar in various formats.

Sar command – installation

How to install and configure SAR (Systat) on Linux server?

The installation steps are quite simple. You can use the package managers YUM, APT-GET etc to install Systat.

Installation steps

>> SSH into server as root.
>> Execute the following command:

yum install sysstat

For Ubuntu use the following command:

sudo apt-get install sysstat

To check the installed version you can use the switch “V” along with the sar command. Please see the sample output:

[root@vps ~]# sar -V
sysstat version 9.0.4
(C) Sebastien Godard (sysstat  orange.fr)

How to check the SAR is working properly?

After the installation, you have to check if it’s working properly or not. You can simply check the functionality by using the following command:

sar 1 2

It’ll display server resources two times with one second interval.

Sar command
Sar command

Different switches available with SAR and its usages

1, Monitoring load average (sar -q)

We can use the switch “q” to obtain load average details. This will report the run queue status (runq-sz), task list status (plist-sz) and the load averages of last 1 minute, 5 minutes, and 15 minutes.

Different usages

sar -q (Lists the details from the staring of this day)

With an interval

sar -q 1 2 (Lists load average details two times with an interval of on second)

From the file

sar -q -f /var/log/sa/sa23 (Fetch load average details of previous dates. Those files are located under “/var/log/sa/”).

Example

[root@vps ~]# sar -q 1 2
Linux 2.6.32-042stab088.4 (vps.crybit.com)      03/19/15        _x86_64_        (8 CPU)

16:16:25      runq-sz  plist-sz   ldavg-1   ldavg-5  ldavg-15
16:16:26            0        34      0.00      0.00      0.00
16:16:27            0        34      0.00      0.00      0.00
Average:            0        34      0.00      0.00      0.00

>> runq-sz : Run queue length (number of tasks waiting for run time).
>> plist-sz : Number of tasks in the task list.
>> ldavg-1 : Load avg past 1 minute.
>> ldavg-5 : Load avg past 5 minute.
>> ldavg-15 : Load avg past 15 minute.

If you see the option “blocked” in sar output, that represents the tasks currently blocked and waiting for I/O operation to complete.

2, Monitoring memory details (sar -r)

The switch “-r” will help you to analyse memory usage by using sar command. The command usages are similar to previous. Different usages are listed below:

sar -r (Lists the details from the staring of this day)

With an interval

sar -r 1 2 (Lists memory usage details two times with an interval of on second)

From the file

sar -r -f /var/log/sa/sa23 (Fetch memory usage details of previous dates. Those files are located under “/var/log/sa/”).

Example

[root@vps ~]# sar -r 1 2
Linux 2.6.32-042stab088.4 (vps.crybit.com)      03/19/15        _x86_64_        (8 CPU)

16:45:59    kbmemfree kbmemused  %memused kbbuffers  kbcached  kbcommit   %commit
16:46:00       109548    414740     79.11         0    300664         0      0.00
16:46:01       109544    414744     79.11         0    300664         0      0.00
Average:       109546    414742     79.11         0    300664         0      0.00

Field descriptions

>> kbmemfree : Amount of free memory available in kilobytes.
>> kbmemused : Amount of used memory in kilobytes. This does not take into account memory used by the kernel itself.
>> %memused : Percentage of used memory.
>> kbbuffers : Amount of memory used as buffers by the kernel in kilobytes.
>> kbcached : Amount of memory used to cache data by the kernel in kilobytes.
>> kbcommit : Amount of memory in kilobytes needed for current workload. This is an estimate of how much RAM/swap is needed to guarantee that there never is out of memory.
>> %commit : Percentage of memory needed for current workload in relation to the total amount of memory (RAM+swap). This number may be greater than 100% because the kernel usually overcommits memory.

3, Sar command to check the swap usage

Here we can use the switch “S” to find the swap usage. The procedures are same as above.

sar -S

With an interval

sar -S 1 3

From the file

sar -S -f /var/log/sa/sa23

Example

[root@vps ~]# sar -S 1 3
Linux 2.6.32-042stab088.4 (vps.crybit.com)      03/19/15        _x86_64_        (8 CPU)

18:33:19    kbswpfree kbswpused  %swpused  kbswpcad   %swpcad
18:33:20            0         0      0.00         0      0.00
18:33:21            0         0      0.00         0      0.00
18:33:22            0         0      0.00         0      0.00
Average:            0         0      0.00         0      0.00

>> kbswpfree : Amount of free swap space in kilobytes.
>> kbswpused : Amount of used swap space in kilobytes.
>> %swpused : Percentage of used swap space.
>> kbswpcad : Amount of cached swap memory in kilobytes. This is memory that once was swapped out, is swapped back in but still also is in the swap area.
>> %swpcad : Percentage of cached swap memory in relation to the amount of used swap space.

Switches to display report in between a time frame (Specified start time and end time)

The switches “s” and “e” are using to define the time frame for the sar report. See the sample reports:

ps command switches, usages and examples in Unix/Linux

This will be a very useful discussions if you are managing Linux servers with many processes. A lot of switches are available with the command “ps” to trace out processes with their metadata. We can list or find-out a lot of information regarding the processes running under our server by simply using the command ps and its proper switches.

4, Start time (s) and End time (e)

Example : Sar report with start time 16:00:00

[root@vps ~]# sar -s 16:00:00
Linux 2.6.32-042stab088.4 (vps.crybit.com)      03/19/15        _x86_64_        (8 CPU)

16:00:01        CPU     %user     %nice   %system   %iowait    %steal     %idle
16:10:01        all      0.02      0.00      0.01      0.00      0.00     99.97
16:20:01        all      0.04      0.00      0.01      0.00      0.00     99.95
16:30:01        all      0.03      0.00      0.01      0.00      0.00     99.97
16:40:01        all      0.02      0.00      0.01      0.00      0.00     99.98
16:50:01        all      0.03      0.00      0.01      0.00      0.00     99.97
17:00:01        all      0.02      0.00      0.01      0.00      0.00     99.97
17:10:01        all      0.02      0.00      0.01      0.00      0.00     99.97
17:20:01        all      0.08      0.00      0.02      0.00      0.00     99.91

End time (e)

Example : Sar report upto 12:00:01

[root@vps ~]# sar -e 12:00:01
Linux 2.6.32-042stab088.4 (vps.crybit.com)      03/19/15        _x86_64_        (8 CPU)

11:00:01        CPU     %user     %nice   %system   %iowait    %steal     %idle
11:10:01        all      0.05      0.00      0.01      0.00      0.00     99.94
11:20:01        all      0.25      0.00      0.06      0.00      0.00     99.69
11:30:02        all      0.07      0.00      0.02      0.00      0.00     99.91
11:40:01        all      0.02      0.00      0.01      0.00      0.00     99.97
11:50:01        all      0.02      0.00      0.01      0.00      0.00     99.97
12:00:01        all      0.02      0.00      0.01      0.00      0.00     99.98
Average:        all      0.07      0.00      0.02      0.00      0.00     99.91

You can also use “s” and “e” option combined to list details in between a time frame.

For example

sar -s 16:00:00 -e 17:00:00

That’s it. A lot of other options are available with SAR which will add very soon… 🙂

Related

1, Load & Memory monitoring using SAR
2, Load monitoring in Linux servers – top, w and uptime commands’ usage for checking the load on server
3, 20+ Rsync command’s switches and common usages
4, What is Rsync over SSH? Command for Rsync over SSH?

Post navigation

Arunlal A

Senior System Developer at Zeta. Linux lover. Traveller. Let's connect! Whether you're a seasoned DevOps pro or just starting your journey, I'm always eager to engage with like-minded individuals. Follow my blog for regular updates, connect on social media, and let's embark on this DevOps adventure together! Happy coding and deploying!

7 thoughts on “Sar command usage with examples in Linux

  1. In my sar report there is script we created to check max and min load average value. But today our server has been restarted after that in that report instead of printing the value of max and min average printing like , max=ldavg-1, min=
    What may be the issue?

Leave a Reply

Your email address will not be published. Required fields are marked *