sar utility is part of the sysstat monitoring tools.
sar collects a huge amount system activity data. This includes data about CPU and memory usage and I/O transfers. By default, stats are collected every ten minutes and kept for 28 days.
RHEL-based systems don’t include
sysstat by default but it is available in the repositories. My article about installing sysstat covers the installation process, as well as some tweaks you might want to make.
sar keeps its data in /var/log/sa/. The directory contains files that start with sa followed by the day of the month. So, the file for 26th May is /var/log/sa/sa26. You can’t view the files with utilities such as
grep – you have to use the
sar shows data for today. The
-f option lets you get data for a different day. For instance, you can use
sar -f /var/log/sa/sa23 to get data for the 23rd. You can also use
-[number] to get data for a previous day. For instance, to get yesterday’s data you can use
Often, you want data for a specific time period. The
-e options specify a start and end time. You need to format the time as HH:MM:SS:
# sar -3 -s 15:30:00 -e 16:00:00 Linux 4.18.0-240.22.1.el8_3.x86_64 (almalinux.vm) 23/05/21 _x86_64_ (16 CPU) 15:30:01 CPU %user %nice %system %iowait %steal %idle 15:40:02 all 0.03 0.00 0.01 0.00 0.01 99.95 15:50:03 all 0.02 0.00 0.01 0.00 0.01 99.96 Average: all 0.02 0.00 0.01 0.00 0.01 99.96
The output always includes a line with metadata. In the above output you can see that I’m running kernel 4.18.0 on a system with the hostname almalinux.vm. The output is for 23rd May, and the system has 16 CPU cores.
I didn’t specify what information I wanted to see. There is no way
sar can display everything, so it showed basic information about the CPU usage. You get the same data when you run
sar -u. You can add the
ALL keyword to get more detailed information (it adds many more columns).
Another common option is
-r, which displays memory utilisation data. You typically want to also use the
-h option to make the data easier to read – it will use mebibytes and gibibytes rather than kibibytes:
# sar -3 -s 15:30:00 -e 16:00:00 -rh Linux 4.18.0-240.22.1.el8_3.x86_64 (almalinux.boxes) 23/05/21 _x86_64_ (16 CPU) 15:30:01 kbmemfree kbavail kbmemused %memused kbbuffers kbcached kbcommit %commit kbactive kbinact kbdirty 15:40:02 5.3G 5.9G 2.3G 30.2% 3.2M 888.0M 7.6G 71.5% 1.2G 579.2M 0.0k 15:50:03 5.3G 5.9G 2.3G 30.2% 3.2M 888.0M 7.6G 71.5% 1.2G 579.2M 0.0k Average: 5.3G 5.9G 2.3G 30.2% 3.2M 888.0M 7.6G 71.5% 1.2G 579.2M 0.0k
As with the
-u option, you can add the
ALL keyword to display more columns.
Although you are most likely to use
sar to view historic data, you can also view statistics about what the system is up to now. Most options let you specify an interval (in seconds) and count. For instance, here I’m using the
-b option to view I/O data. The data is refreshed every three seconds for five times:
# sar -b 3 5 ... 14:43:40 tps rtps wtps bread/s bwrtn/s 14:43:43 56.33 26.67 29.67 365.33 626.67 14:43:46 58.33 27.33 31.00 445.33 712.00 14:43:49 117.67 115.33 2.33 1685.33 376.00 14:43:52 99.33 85.00 14.33 1378.67 354.67 14:43:55 8.33 0.00 8.33 0.00 354.67 Average: 68.00 50.87 17.13 774.93 484.80
-o option lets you save the output to a data file. You won’t be able to view the file in a text editor. As with the files in /var/log/sa/, you have to use
sar (with the above-mentioned
-f option). Also,
sar always collects all data. You can’t save only, say, I/O data and ignore the rest.
For instance, here
sar collects data every second for one minute. The output is saved to a file named stats:
# sar -o stats 1 60 >/dev/null 2>&1
After the command has finished you can use the
-f option to view data. For instance, you can use the
-b option to show I/O data:
# sar -b -f stats
If you just want a report that shows the output of a command then you can of course output redirection. For instance, the following command creates a plain text file named
io_stats with the output of the command
sar -b 1 60:
# sar -b 1 60 > io_stats
sar collects much more data than I covered in this article. I haven’t explained the I/O statistic and haven’t touched on swap data, for instance. However, this introduction hopefully shows that it is a really useful tool.
For more information, the man page (
man 1 sar) is quite thorough. The main obstacle to learning how to use
sar is that it collects a huge amount of technical data. To properly understand
sar you need to be familiar with what data is collected and how it should be interpreted. I recommend starting with the memory and CPU statistics and to go from there. As and when you run into specific issues you can learn more about other metrics. And of course, contact us if you are after specific data but don’t quite know where to start.