NAME¶

sar - Collect, report, or save system activity information.

SYNOPSIS¶

sar [ -A ] [ -b ] [ -B ] [ -C ] [ -d ] [ -h ] [ -i interval ] [ -m ] [ -p ] [ -q ] [ -r ] [ -R ] [ -S ] [ -t ] [ -u [ ALL ] ] [ -v ] [ -V ] [ -w ] [ -W ] [ -y ] [ -j { ID | LABEL | PATH | UUID | ... } ] [ -n { keyword [,...] | ALL } ] [ -I { int [,...] | SUM | ALL | XALL } ] [ -P { cpu [,...] | ALL } ] [ -o [ filename ] | -f [ filename ] ] [ --legacy ] [ -s [ hh:mm:ss ] ] [ -e [ hh:mm:ss ] ] [ interval [ count ] ]

DESCRIPTION¶

The sar command writes to standard output the contents of selected cumulative activity counters in the operating system. The accounting system, based on the values in the count and interval parameters, writes information the specified number of times spaced at the specified intervals in seconds. If the interval parameter is set to zero, the sar command displays the average statistics for the time since the system was started. If the interval parameter is specified without the count parameter, then reports are generated continuously. The collected data can also be saved in the file specified by the -o filename flag, in addition to being displayed onto the screen. If filename is omitted, sar uses the standard system activity daily data file, the /var/log/sa/sadd file, where the dd parameter indicates the current day. By default all the data available from the kernel are saved in the data file.

The sar command extracts and writes to standard output records previously saved in a file. This file can be either the one specified by the -f flag or, by default, the standard system activity daily data file.

Without the -P flag, the sar command reports system-wide (global among all processors) statistics, which are calculated as averages for values expressed as percentages, and as sums otherwise. If the -P flag is given, the sar command reports activity which relates to the specified processor or processors. If -P ALL is given, the sar command reports statistics for each individual processor and global statistics among all processors.

You can select information about specific system activities using flags. Not specifying any flags selects only CPU activity. Specifying the -A flag is equivalent to specifying -bBdqrRSvwWy -I SUM -I XALL -n ALL -u ALL -P ALL.

The default version of the sar command (CPU utilization report) might be one of the first facilities the user runs to begin system activity investigation, because it monitors major system resources. If CPU utilization is near 100 percent (user + nice + system), the workload sampled is CPU-bound.

If multiple samples and multiple reports are desired, it is convenient to specify an output file for the sar command. Run the sar command as a background process. The syntax for this is:

sar -o datafile interval count >/dev/null 2>&1 &

All data is captured in binary form and saved to a file (datafile). The data can then be selectively displayed with the sar command using the -f option. Set the interval and count parameters to select count records at interval second intervals. If the count parameter is not set, all the records saved in the file will be selected. Collection of data in this manner is useful to characterize system usage over a period of time and determine peak usage hours.

Note: The sar command only reports on local activities.

OPTIONS¶

-A

This is equivalent to specifying -bBdqrRSuvwWy -I SUM -I XALL -n ALL -u ALL -P ALL.

-b

Report I/O and transfer rate statistics. The following values are displayed:

tps

-B

Report paging statistics. Some of the metrics below are available only with post 2.5 kernels. The following values are displayed:

pgpgin/s

-C

When reading data from a file, tell sar to display comments that have been inserted by sadc.

-d

Report activity for each block device (kernels 2.4 and newer only). When data is displayed, the device specification dev m-n is generally used ( DEV column). m is the major number of the device. With recent kernels (post 2.5), n is the minor number of the device, but is only a sequence number with pre 2.5 kernels. Device names may also be pretty-printed if option -p is used or persistent device names can be printed if option -j is used (see below). Values for fields avgqu-sz, await, svctm and %util may be unavailable and displayed as 0.00 with some 2.4 kernels. Note that disk activity depends on sadc options "-S DISK" and "-S XDISK" to be collected. The following values are displayed:

tps

-e [ hh:mm:ss ]

Set the ending time of the report. The default ending time is 18:00:00. Hours must be given in 24-hour format. This option can be used when data are read from or written to a file (options -f or -o ).

-f [ filename ]

Extract records from filename (created by the -o filename flag). The default value of the filename parameter is the current daily data file, the /var/log/sa/sadd file. The -f option is exclusive of the -o option.

-h

Display a short help message then exit.

-i interval

Select data records at seconds as close as possible to the number specified by the interval parameter.

-I { int [,...] | SUM | ALL | XALL }

Report statistics for a given interrupt. int is the interrupt number. Specifying multiple -I int parameters on the command line will look at multiple independent interrupts. The SUM keyword indicates that the total number of interrupts received per second is to be displayed. The ALL keyword indicates that statistics from the first 16 interrupts are to be reported, whereas the XALL keyword indicates that statistics from all interrupts, including potential APIC interrupt sources, are to be reported. Note that interrupt statistics depend on sadc option "-S INT" to be collected.

-j { ID | LABEL | PATH | UUID | ... }

Display persistent device names. Use this option in conjunction with option -d. Options ID, LABEL, etc. specify the type of the persistent name. These options are not limited, only prerequisite is that directory with required persistent names is present in /dev/disk. If persistent name is not found for the device, the device name is pretty-printed (see option -p below).

--legacy

Enable reading older /var/log/sa/sadd data files. In Red Hat Enterprise Linux 6.3, the sysstat package was updated to version 9.0.4-20. This update changed the format of /var/log/sa/sadd data files, but unfortunately, the format version was not updated. Because of this, sysstat did not restrict reading of data files in old format and while interpreting them, some displayed values could have been incorrect. The updated sysstat package in Red Hat Enterprise Linux 6.5 contains fixed format version of data files and prevents reading data files created by older sysstat packages. However, data files created by the sysstat packages from Red Hat Enterprise Linux 6.3 and 6.4 are fully compatible with the sysstat package from Red Hat Enterprise Linux 6.5. To enable latest sysstat to read older data files, use this option. Note that this option allows you to read also data files created on Red Hat Enterprise Linux 6.2 and earlier, however, these files are not compatible with the latest sysstat package.

-m

Report power management statistics. Note that these statistics depend on sadc option "-S POWER" to be collected. The following value is displayed:

MHz

-n { keyword [,...] | ALL }

Report network statistics.

Possible keywords are DEV, EDEV, NFS, NFSD, SOCK, IP, EIP, ICMP, EICMP, TCP, ETCP, UDP, SOCK6, IP6, EIP6, ICMP6, EICMP6 and UDP6.

With the DEV keyword, statistics from the network devices are reported. The following values are displayed:

IFACE

-o [ filename ]

Save the readings in the file in binary form. Each reading is in a separate record. The default value of the filename parameter is the current daily data file, the /var/log/sa/sadd file. The -o option is exclusive of the -f option. All the data available from the kernel are saved in the file (in fact, sar calls its data collector sadc with the option "-S ALL". See sadc(8) manual page).

-P { cpu [,...] | ALL }

Report per-processor statistics for the specified processor or processors. Specifying the ALL keyword reports statistics for each individual processor, and globally for all processors. Note that processor 0 is the first processor.

-p

Pretty-print device names. Use this option in conjunction with option -d. By default names are printed as dev m-n where m and n are the major and minor numbers for the device. Use of this option displays the names of the devices as they (should) appear in /dev. Name mappings are controlled by /etc/sysconfig/sysstat.ioconf.

-q

Report queue length and load averages. The following values are displayed:

runq-sz

-r

Report memory utilization statistics. The following values are displayed:

kbmemfree

-R

Report memory statistics. The following values are displayed:

frmpg/s

-s [ hh:mm:ss ]

Set the starting time of the data, causing the sar command to extract records time-tagged at, or following, the time specified. The default starting time is 08:00:00. Hours must be given in 24-hour format. This option can be used only when data are read from a file (option -f ).

-S

Report swap space utilization statistics. The following values are displayed:

kbswpfree

-t

When reading data from a daily data file, indicate that sar should display the timestamps in the original locale time of the data file creator. Without this option, the sar command displays the timestamps in the user's locale time.

-u [ ALL ]

Report CPU utilization. The ALL keyword indicates that all the CPU fields should be displayed. The report may show the following fields:

%user

-v

Report status of inode, file and other kernel tables. The following values are displayed:

dentunusd

-V

Print version number then exit.

-w

Report task creation and system switching activity.

proc/s

-W

Report swapping statistics. The following values are displayed:

pswpin/s

-y

Report TTY device activity. The following values are displayed:

rcvin/s

ENVIRONMENT¶

The sar command takes into account the following environment variables:

S_TIME_FORMAT

If this variable exists and its value is ISO then the current locale will be ignored when printing the date in the report header. The sar command will use the ISO 8601 format (YYYY-MM-DD) instead.

S_TIME_DEF_TIME

If this variable exists and its value is UTC then sar will save its data in UTC time (data will still be displayed in local time). sar will also use UTC time instead of local time to determine the current daily data file located in the /var/log/sa directory. This variable may be useful for servers with users located across several timezones.

EXAMPLES¶

sar -u 2 5

sar -I 14 -o int14.file 2 10

sar -r -n DEV -f /var/log/sa/sa16

sar -A

BUGS¶

/proc filesystem must be mounted for the sar command to work.

All the statistics are not necessarily available, depending on the kernel version used.

FILES¶

/var/log/sa/sadd

AUTHOR¶

Sebastien Godard (sysstat <at> orange.fr)

SEE ALSO¶

sadc(8), sa1(8), sa2(8), sadf(1), isag(1), pidstat(1), mpstat(1), iostat(1), vmstat(8)

http://pagesperso-orange.fr/sebastien.godard/