Sar is one of the smart command line utility in Linux. Also, System Activity Reporter (SAR) is one of the important tool to monitor Linux servers.This command will helps system administrators to check the server resources status at different time frames. By using this command we can analyse the history of different resource usages.
We already discussed the “Load and Memory monitoring using SAR“. In this article I’m explaining the installation steps and the command line usages.
Sar is part of the sysstat package. According to the package, it includes the following system performance tools:
>> sar: collects and reports system activity information;
>> iostat: reports CPU utilization and disk I/O statistics;
>> mpstat: reports global and per-processor statistics;
>> pidstat: reports statistics for Linux tasks (processes);
>> sadf: displays data collected by sar in various formats.
Sar command – installation
How to install and configure SAR (Systat) on Linux server?
The installation steps are quite simple. You can use the package managers YUM, APT-GET etc to install Systat.
>> SSH into server as root.
>> Execute the following command:
yum install sysstat
For Ubuntu use the following command:
sudo apt-get install sysstat
To check the installed version you can use the switch “V” along with the sar command. Please see the sample output:
[[email protected] ~]# sar -V sysstat version 9.0.4 (C) Sebastien Godard (sysstat orange.fr)
How to check the SAR is working properly?
After the installation, you have to check if it’s working properly or not. You can simply check the functionality by using the following command:
sar 1 2
It’ll display server resources two times with one second interval.
Different switches available with SAR and its usages
1, Monitoring load average (sar -q)
We can use the switch “q” to obtain load average details. This will report the run queue status (runq-sz), task list status (plist-sz) and the load averages of last 1 minute, 5 minutes, and 15 minutes.
sar -q (Lists the details from the staring of this day)
With an interval
sar -q 1 2 (Lists load average details two times with an interval of on second)
From the file
sar -q -f /var/log/sa/sa23 (Fetch load average details of previous dates. Those files are located under “/var/log/sa/”).
[[email protected] ~]# sar -q 1 2 Linux 2.6.32-042stab088.4 (vps.crybit.com) 03/19/15 _x86_64_ (8 CPU) 16:16:25 runq-sz plist-sz ldavg-1 ldavg-5 ldavg-15 16:16:26 0 34 0.00 0.00 0.00 16:16:27 0 34 0.00 0.00 0.00 Average: 0 34 0.00 0.00 0.00
>> runq-sz : Run queue length (number of tasks waiting for run time).
>> plist-sz : Number of tasks in the task list.
>> ldavg-1 : Load avg past 1 minute.
>> ldavg-5 : Load avg past 5 minute.
>> ldavg-15 : Load avg past 15 minute.
If you see the option “blocked” in sar output, that represents the tasks currently blocked and waiting for I/O operation to complete.
2, Monitoring memory details (sar -r)
The switch “-r” will help you to analyse memory usage by using sar command. The command usages are similar to previous. Different usages are listed below:
sar -r (Lists the details from the staring of this day)
With an interval
sar -r 1 2 (Lists memory usage details two times with an interval of on second)
From the file
sar -r -f /var/log/sa/sa23 (Fetch memory usage details of previous dates. Those files are located under “/var/log/sa/”).
[[email protected] ~]# sar -r 1 2 Linux 2.6.32-042stab088.4 (vps.crybit.com) 03/19/15 _x86_64_ (8 CPU) 16:45:59 kbmemfree kbmemused %memused kbbuffers kbcached kbcommit %commit 16:46:00 109548 414740 79.11 0 300664 0 0.00 16:46:01 109544 414744 79.11 0 300664 0 0.00 Average: 109546 414742 79.11 0 300664 0 0.00
>> kbmemfree : Amount of free memory available in kilobytes.
>> kbmemused : Amount of used memory in kilobytes. This does not take into account memory used by the kernel itself.
>> %memused : Percentage of used memory.
>> kbbuffers : Amount of memory used as buffers by the kernel in kilobytes.
>> kbcached : Amount of memory used to cache data by the kernel in kilobytes.
>> kbcommit : Amount of memory in kilobytes needed for current workload. This is an estimate of how much RAM/swap is needed to guarantee that there never is out of memory.
>> %commit : Percentage of memory needed for current workload in relation to the total amount of memory (RAM+swap). This number may be greater than 100% because the kernel usually overcommits memory.
3, Sar command to check the swap usage
Here we can use the switch “S” to find the swap usage. The procedures are same as above.
With an interval
sar -S 1 3
From the file
sar -S -f /var/log/sa/sa23
[[email protected] ~]# sar -S 1 3 Linux 2.6.32-042stab088.4 (vps.crybit.com) 03/19/15 _x86_64_ (8 CPU) 18:33:19 kbswpfree kbswpused %swpused kbswpcad %swpcad 18:33:20 0 0 0.00 0 0.00 18:33:21 0 0 0.00 0 0.00 18:33:22 0 0 0.00 0 0.00 Average: 0 0 0.00 0 0.00
>> kbswpfree : Amount of free swap space in kilobytes.
>> kbswpused : Amount of used swap space in kilobytes.
>> %swpused : Percentage of used swap space.
>> kbswpcad : Amount of cached swap memory in kilobytes. This is memory that once was swapped out, is swapped back in but still also is in the swap area.
>> %swpcad : Percentage of cached swap memory in relation to the amount of used swap space.
Switches to display report in between a time frame (Specified start time and end time)
The switches “s” and “e” are using to define the time frame for the sar report. See the sample reports:
ps command switches, usages and examples in Unix/Linux
This will be a very useful discussions if you are managing Linux servers with many processes. A lot of switches are available with the command “ps” to trace out processes with their metadata. We can list or find-out a lot of information regarding the processes running under our server by simply using the command ps and its proper switches.
4, Start time (s) and End time (e)
Example : Sar report with start time 16:00:00
[[email protected] ~]# sar -s 16:00:00 Linux 2.6.32-042stab088.4 (vps.crybit.com) 03/19/15 _x86_64_ (8 CPU) 16:00:01 CPU %user %nice %system %iowait %steal %idle 16:10:01 all 0.02 0.00 0.01 0.00 0.00 99.97 16:20:01 all 0.04 0.00 0.01 0.00 0.00 99.95 16:30:01 all 0.03 0.00 0.01 0.00 0.00 99.97 16:40:01 all 0.02 0.00 0.01 0.00 0.00 99.98 16:50:01 all 0.03 0.00 0.01 0.00 0.00 99.97 17:00:01 all 0.02 0.00 0.01 0.00 0.00 99.97 17:10:01 all 0.02 0.00 0.01 0.00 0.00 99.97 17:20:01 all 0.08 0.00 0.02 0.00 0.00 99.91
End time (e)
Example : Sar report upto 12:00:01
[[email protected] ~]# sar -e 12:00:01 Linux 2.6.32-042stab088.4 (vps.crybit.com) 03/19/15 _x86_64_ (8 CPU) 11:00:01 CPU %user %nice %system %iowait %steal %idle 11:10:01 all 0.05 0.00 0.01 0.00 0.00 99.94 11:20:01 all 0.25 0.00 0.06 0.00 0.00 99.69 11:30:02 all 0.07 0.00 0.02 0.00 0.00 99.91 11:40:01 all 0.02 0.00 0.01 0.00 0.00 99.97 11:50:01 all 0.02 0.00 0.01 0.00 0.00 99.97 12:00:01 all 0.02 0.00 0.01 0.00 0.00 99.98 Average: all 0.07 0.00 0.02 0.00 0.00 99.91
You can also use “s” and “e” option combined to list details in between a time frame.
sar -s 16:00:00 -e 17:00:00
That’s it. A lot of other options are available with SAR which will add very soon… 🙂
1, Load & Memory monitoring using SAR
2, Load monitoring in Linux servers – top, w and uptime commands’ usage for checking the load on server
3, 20+ Rsync command’s switches and common usages
4, What is Rsync over SSH? Command for Rsync over SSH?
7 thoughts on “Sar command usage with examples in Linux”
You saved my neck bro!!! I was searching for this “sar -s 16:00:00 -e 17:00:00” option!!! Thanks a lot <3
Ha ha… Lol
Most welcome buddy!!
In my sar report there is script we created to check max and min load average value. But today our server has been restarted after that in that report instead of printing the value of max and min average printing like , max=ldavg-1, min=
What may be the issue?
Is the “sar” command working correctly?
Great tutorial. Next step could be to analyze sar report to get charts and aggregated data. For that we can follow https://github.com/sumitbiswasgit/sarbox
how to find memory usage using sar command on particular process?
you can use “pidstat -r” command for this purpose.