How to use the sar utility

31 May 2021

The sar utility is part of the sysstat monitoring tools. sar collects a huge amount system activity data. This includes data about CPU and memory usage and I/O transfers. By default, stats are collected every ten minutes and kept for 28 days.

RHEL-based systems don’t include sysstat by default but it is available in the repositories. My article about installing sysstat covers the installation process, as well as some tweaks you might want to make.

Data files

sar keeps its data in /var/log/sa/. The directory contains files that start with sa followed by the day of the month. So, the file for 26th May is /var/log/sa/sa26. You can’t view the files with utilities such as cat and grep – you have to use the sar utility.

Using sar

By default sar shows data for today. The -f option lets you get data for a different day. For instance, you can use sar -f /var/log/sa/sa23 to get data for the 23rd. You can also use -[number] to get data for a previous day. For instance, to get yesterday’s data you can use sar -1.

Often, you want data for a specific time period. The -s and -e options specify a start and end time. You need to format the time as HH:MM:SS:

# sar -3 -s 15:30:00 -e 16:00:00
Linux 4.18.0-240.22.1.el8_3.x86_64 (almalinux.vm) 	23/05/21 	_x86_64_	(16 CPU)

15:30:01        CPU     %user     %nice   %system   %iowait    %steal     %idle
15:40:02        all      0.03      0.00      0.01      0.00      0.01     99.95
15:50:03        all      0.02      0.00      0.01      0.00      0.01     99.96
Average:        all      0.02      0.00      0.01      0.00      0.01     99.96

Getting relevant data

The output always includes a line with metadata. In the above output you can see that I’m running kernel 4.18.0 on a system with the hostname almalinux.vm. The output is for 23rd May, and the system has 16 CPU cores.

I didn’t specify what information I wanted to see. There is no way sar can display everything, so it showed basic information about the CPU usage. You get the same data when you run sar -u. You can add the ALL keyword to get more detailed information (it adds many more columns).

Another common option is -r, which displays memory utilisation data. You typically want to also use the -h option to make the data easier to read – it will use mebibytes and gibibytes rather than kibibytes:

# sar -3 -s 15:30:00 -e 16:00:00 -rh
Linux 4.18.0-240.22.1.el8_3.x86_64 (almalinux.boxes) 	23/05/21 	_x86_64_	(16 CPU)

15:30:01    kbmemfree   kbavail kbmemused  %memused kbbuffers  kbcached  kbcommit   %commit  kbactive   kbinact   kbdirty
15:40:02         5.3G      5.9G      2.3G     30.2%      3.2M    888.0M      7.6G     71.5%      1.2G    579.2M      0.0k
15:50:03         5.3G      5.9G      2.3G     30.2%      3.2M    888.0M      7.6G     71.5%      1.2G    579.2M      0.0k
Average:         5.3G      5.9G      2.3G     30.2%      3.2M    888.0M      7.6G     71.5%      1.2G    579.2M      0.0k

As with the -u option, you can add the ALL keyword to display more columns.

Viewing live data

Although you are most likely to use sar to view historic data, you can also view statistics about what the system is up to now. Most options let you specify an interval (in seconds) and count. For instance, here I’m using the -b option to view I/O data. The data is refreshed every three seconds for five times:

# sar -b 3 5
...
14:43:40          tps      rtps      wtps   bread/s   bwrtn/s
14:43:43        56.33     26.67     29.67    365.33    626.67
14:43:46        58.33     27.33     31.00    445.33    712.00
14:43:49       117.67    115.33      2.33   1685.33    376.00
14:43:52        99.33     85.00     14.33   1378.67    354.67
14:43:55         8.33      0.00      8.33      0.00    354.67
Average:        68.00     50.87     17.13    774.93    484.80

Saving reports

The -o option lets you save the output to a data file. You won’t be able to view the file in a text editor. As with the files in /var/log/sa/, you have to use sar (with the above-mentioned -f option). Also, sar always collects all data. You can’t save only, say, I/O data and ignore the rest.

For instance, here sar collects data every second for one minute. The output is saved to a file named stats:

# sar -o stats 1 60 >/dev/null 2>&1

After the command has finished you can use the -f option to view data. For instance, you can use the -b option to show I/O data:

# sar -b -f stats

If you just want a report that shows the output of a command then you can of course output redirection. For instance, the following command creates a plain text file named io_stats with the output of the command sar -b 1 60:

# sar -b 1 60 > io_stats

Where to go from here

sar collects much more data than I covered in this article. I haven’t explained the I/O statistic and haven’t touched on swap data, for instance. However, this introduction hopefully shows that it is a really useful tool.

For more information, the man page (man 1 sar) is quite thorough. The main obstacle to learning how to use sar is that it collects a huge amount of technical data. To properly understand sar you need to be familiar with what data is collected and how it should be interpreted. I recommend starting with the memory and CPU statistics and to go from there. As and when you run into specific issues you can learn more about other metrics. And of course, contact us if you are after specific data but don’t quite know where to start.