What is sar linux

Sar Command in Linux with Examples

Sar command is used to produce statistical reports on a variety of resources including CPU usage, memory utilization, I/O devices consumption, network monitor, swap, and load averages.

SAR stands for System Activity Reporter, very useful tools for any Linux administrator to monitor the system performance and to investigate the bottlenecks. This tool is provided by the sysstat package.

In this tutorial, we will go through how to install sysstat package and use sar command on Linux.

Install sysstat package

The sysstat package contains many utilities which are a collection of performance monitoring tools for Linux system. Sar is a tool which belong to sysstat package.

Installing sysstat package on RHEL and CentOS

Once the sysstat has been installed successfully, verifying the installation by command:

By default, sysstat will store the server statistics in the file ‘/var/log/sa/saDD’ (DD is day of month, for example: /var/log/sa/sa08) and will keep the data for 28 days. If you want to keep the data more that, you need to modify the sysstat configuration file ‘/etc/sysconfig/sysstat’.

Modify the value of HISTORY with the number of days you want to keep the logs.

Installing sysstat package on Ubuntu and Debian

Verifying the installation by command:

On Ubuntu, we need to enable it while CentOS is not needed.

Using your favorite editor (vim, nano or gedit) to edit the following file:

And set ENABLED to true :

Restart the service

On Ubuntu, the configuration file is ‘/etc/sysstat/sysstat’ and the data will be kept in 7 days by default.

From Fedora 21, sysstat comes by default and all you need to do is running below commands:

There is a cron job for sysstat which runs in every 10 minutes to collect data and will store it in the corresponding file /var/log/sa/saDD. If you want to change the interval of this cron run, you can modify it in ‘/etc/cron.d/sysstat’.

For systemd, the timer unit file calls sysstat-collect.service (/usr/lib/systemd/system/sysstat-collect.service) every 10 minutes to collect the stats.

Sar command usage

The basic syntax for sar command usage is as follows:

interval: the period in seconds.

count: number of times to make output statistics.

1. Find CPU activity

By default (with no other options given) sar command will report the CPU activity of the server. Also, the option -u can be used to get the CPU utilization report.

If you want to get the CPU activity report in every 2 seconds for 3 times, you can use the following sar command:

%user denotes the percentage of CPU utilization that occurred while executing at the user level (user space)

%system denotes the percentage of CPU utilization that occurred while executing at the system level (kernel space)

%idle is the percentage of time that the CPU or CPUs were idle and the system did not have an outstanding disk I/O request.

If you want to get the output in a file in binary form, you need to append -o filename with the sar command. For example:

Also, you can get the CPU activity report of a particular day, say: June 09th, 2020. You can find it as:

2. Find CPU usage for each processor

The -u option provides the CPU usage on all processors. If you want to find the CPU activity on all processors separately, you need to use the -P option.

3. Find Memory usage

You can find the memory usage (used and free memory of the server) over time using the -r switch.

kbmemfree indicates the amount of free memory available in kilobytes.

kbmemused indicates the amount of used memory in kilobytes. This does not take into account memory used by the kernel itself.

If you want to gather the memory usage for a particular day say: Sept 05, you need to run it as below command:

4. Find Swapping activity

You can check the swap usage of the machine using the -W option.

pswpin/s indicates the total number of swap pages the system brought in per second.

pswpout/s indicates the total number of swap pages the system brought out per second.

If you want to gather the swap usages for a particular day say Sept 05, you need to run it as following sar command:

5. Find load averages over time

You can find the load averages overtime using the -q option.

runq-sz: It shows the run queue length (number of tasks waiting for run time).

plist-sz: It shows the number of tasks in the task list.

ldavg-1/5/15: System load average for the last minute/ past 5 minutes/ past 15 minutes.

If you want to gather the load averages for a particular day, say Sept 05, you need to run it following sar command:

6. Report of mounted filesystems

You can get the statistics for currently filesystems using the -F option

If you want to collect the mounted filesystems for a particular day, say June 10th.

7. Report details of inode, kernel tables and file tables

You can get the details of inode, processes, kernel threads and file tables used by the system by using sar command with -v option.

dentunusd: number of unused cache entries in the directory cache

file-nr: numbers of in-use file handles

inode-nr: inode handlers

pty-nr: pseudo terminals

8. Check CPU bottleneck

You can use sar command to find out which interrupt number possible causing CPU bottleneck.

In the below example #9 was the highest excluding system interrupt #0 .

Details in ‘/proc/interrupts’ file will also find helpful for you. Interrupt halts processing momentarily so that I/O or other operations can occur. Processing resumes after the specific operation takes place. So it is very important that each device installed in machine must be provided with an interrupt setting that does not conflict with the settings used by the hardware and other peripherals.

The first column refers to the IRQ number. The next column reports the type of interrupt and the last column contains the name of the device that is located to IRQ.

9. Report network statistics

In order to get the report of the network statistics, using sar command with -n option. For example:

DEV: statistics from the network devices are reported

IFACE: name of the interface (In the above example: ens192)

rxpck/s / txpck/s: total number of packets received / transmitted per second

There are some other options than DEV, such as:

NFS: show NFS client activities

SOCK: indicate the sockets in use

TCP: indicate TCP v4 network traffic

UDP: indicate UDP v4 network traffic

If you want to gather the network statistics for a particular day say June 09, you need to run it as follows:

Sar graph

The above sections explained the way to use sar from the terminal. kSar is a java-based GUI application that visualizes your sar data.

Download ksar and unpack it:

Now cd into dir

Now make run.sh file executable and run it as root.

Now we can test by running local command. We go to Data > Run Local Command and there we can use default command.

Next, we can look at the graphs by clicking on the left panel and looking in the right side the displayed graph:

It is also possible to load graphs from file. First, we need to run sar:

And then in menus, we select Data > Load from text file and find the file in /tmp or wherever we have saved it.

Conclusion

In this tutorial, we learned how sar command can be used to help you notice the usage of system resources and improve performance while working with your operating system.

From sar examples, it’s clear that it is a great tool to collect, report, or save system activity information.

Thanks for reading and please leave your suggestion in the below comment section.

Источник

What is sar linux

Last updated on: 2019-01-18

Authored by: Rackspace Community

This article presents 10 ways that you can use the System Activity Report (sar) command to monitor resources in Linux®.

1. Display the collective usage of all CPUs

Run the following command to display a summary of CPU usage:

This command outputs the cumulative, real-time resource use of all CPUs.

You can add more parameters to this command. For example, adding 1 3 at the end of the command as shown in the following example reports for every 1 second a total of 3 times:

The output is similar to the following example:

The last field, %idle , indicates the CPU load.

The command has the following variations:

• sar -u : Displays CPU usage for the current day.
• sar -u 1 3 : Displays real-time CPU usage every 1 second for 3 times.
• sar -u ALL : Same as the sar -u command, but displays additional fields.
• sar -u ALL 1 3 : Same as the sar -u 1 3 command, but displays additional fields.
• sar -u -f /var/log/sa/sa10 : Displays CPU usage for the tenth day of the month from the sa10 file.

2. Display CPU usage by CPU or core

Run the following command to display CPU usage by CPU or core:

The -P ALL flag indicates that you want to display statistics for all of the individual cores.

In the CPU column of the following example output, 0 , 1 , 2 , and 3 are CPU core numbers:

If you want to display statistics for only the second core, use the -P 1 flag (because core numbers start from 0), as shown in the following example:

The output looks like the following example:

You might also find the following variations helpful:

• sar -P ALL : Displays CPU usage for each core for the current day.
• sar -P ALL 1 3 : Displays real-time CPU usage of each core every 1 second for 3 times.
• sar -P 1 : Displays CPU usage for core number 1 for the current day.
• sar -P 1 1 3 : Displays real-time CPU usage for core number 1, every 1 second for 3 times.
• sar -P ALL -f /var/log/sa/sa10 : Displays CPU usage for each core for the tenth day of the month from the sa10 file.

3. Display free and used memory

Run the following command to display free and used memory:

If you add 1 3 to the command as shown in the following example, the output reports for every 1 second a total of 3 times:

The output looks like the following example, in which kbmemfree is free memory and kbmemused is used memory:

This command has the following variations:

4. Display swap space use

Run the following command to display the amount of swap space that is in use:

If you add 1 3 to the end of the command as shown in the following example, the output reports for every 1 second a total of 3 times:

The output is similar to the following example:

Note: If the kbswpused and %swpused are at 0 , then your system is not swapping.

This command has the following variations:

Additional swap space commands

You might also find the following swap space commands helpful:

• Use sar -R to identify the number of memory pages that the system has freed, used, and cached.
• Use sar -H to identify the Linux® HugePages (in kilobytes (KB)) that are in use and available.
• Use sar -B to generate paging statistics such as the number of KB paged in (and out) from disk per second.
• Use sar -W to generate page swap statistics, such as page swap in (and out) per second.

5. Display I/O activities

Run the following command to display overall input and output (I/O) activities:

The output from this command displays I/O statistics. If you add 1 3 to the end of the command as shown in the following example, the output reports for every 1 second a total of 3 times:

The output looks like the following example:

The output includes the following fields:

• tps : Transactions per second (both read and write)
• rtps : Read transactions per second
• wtps : Write transactions per second
• bread/s : Bytes read per second
• bwrtn/s : Bytes written per second

This command has the following variations:

Note: Use sar -v to display the number of inode handlers, file handlers, and pseudo-terminals that the system is using.

6. Display the I/O activities of individual block devices

Run the following command to display the I/O activities of individual block devices:

To identify activities by individual block device (such as a specific mount point, logical unit number (LUN), or partition), use sar -d , as shown in the following example:

The output looks like the following example:

In this example, the values in the DEV column represent specific block devices. For example, dev53-1 means a block device with 53 as major number, and 1 as minor number.

You can use the pretty print ( -p ) flag as shown in the following example to make the column display the actual device name (such as sda, sda1, or sdb1):

The output looks like the following example:

This command has the following variations:

• sar -d
• sar -d 1 3
• sar -d -f /var/log/sa/sa10
• sar -p -d

7. Display the context switch per second

Run the following command to display the context switch per second:

This command reports the total number of processes created per second and the total number of context switches per second. If you add 1 3 to the end of the command as shown in the following example, it reports for every 1 second a total of 3 times:

The output is similar to the following example:

This command has the following variations:

8. Display the run queue and load average

Run the following command to display the run queue and load average:

This command reports the run queue size and load average for the past minute, past 5 minutes, and past 15 minutes. If you add 1 3 to the end of the command as shown in the following example, it reports for every 1 second a total of 3 times:

The output looks like the following example:

Note: The blocked column displays the number of tasks that are currently blocked and waiting for I/O operations to complete.

This command has the following variations:

9. Display network statistics

Run the following command to display network statistics:

This command reports various network statistics, such as the number of packets received (transmitted) through the network card or the number of packet failures that occurred. If you add 1 3 to the end of the command, it reports for every 1 second a total of 3 times.

You can also add a keyword to the command, as shown in the following example:

KEYWORD can be one of the following options:

• DEV : Displays vital statistics for network devices
• EDEV : Display failure statistics for network devices
• NFS : Displays Network File System (NFS) client activities
• NFSD : Displays NFS server activities
• SOCK : Displays the sockets that are in use for IPv4
• IP : Displays IPv4 network traffic
• EIP : Displays IPv4 network errors
• ICMP : Displays ICMPv4 network traffic
• EICMP : Displays ICMPv4 network errors
• TCP : Displays TCPv4 network traffic
• ETCP : Displays TCPv4 network errors
• UDP : Displays UDPv4 network traffic
• SOCK6 , IP6 , EIP6 , ICMP6 , and UDP6 : Displays IPv6 network information
• ALL : Displays all of the preceding information

The following example uses the DEV keyword:

The output looks like the following example:

10. Report sar data by start time

Run the following command to report sar data by start time:

When you view historical sar data from the /var/log/sa/saXX file by using the sar -f option, the output displays all of the sar data for that specific day beginning at 12:00 a.m.

You can use the -s hh:mi:ss option to specify the start time. For example, if you specify sar -s 10:00:00 , the output from the command displays the sar data beginning at 10 a.m. (instead of the default of midnight).

You can combine the -s flag with other sar flags. For example, to report the load average on the 26th of the current month starting from 10 a.m., combine the -q and -s flags as shown in the following example:

The output looks like the following example:

You cannot specify an end time. Instead, you need to use the head command. For example, if you want to start from 10 a.m. and see 7 entries, you pipe the preceding output to head -n 10 , as shown in the following example:

The output looks like the following example:

Share this information:

©2020 Rackspace US, Inc.

Except where otherwise noted, content on this site is licensed under a Creative Commons Attribution-NonCommercial-NoDerivs 3.0 Unported License

Источник