SAR command introduction in Linux

SAR often used as an acronym for system activity reporter, is a versatile performance monitoring tool that forms an integral part of any system administrators’ toolkit. In Linux, the sar utility is installed as a part of the sysstat package.

We may verify this by listing the files installed as a part of the sysstat rpm and search for sar as shown below:

[sahil@linuxnix:~] $ rpm -qa | grep sysstat

[sahil@linuxnix:~] $ rpm -ql sysstat | grep sar

The sysstat package is installed by default on a newly built system but can be installed manually as well with the following command.

Install sysstat in Redhat/Fedora/CentOS Linux

We use yum command to install sysstat in Linux.

[root@linuxnix /]# yum install sysstat
Loaded plugins: fastestmirror, ovl
base | 3.6 kB 00:00:00 
extras | 3.4 kB 00:00:00 
updates | 3.4 kB 00:00:00 
---> Package sysstat.x86_64 0:10.1.5-12.el7 will be installed
 sysstat x86_64 10.1.5-12.el7 base 310 k
 sysstat.x86_64 0:10.1.5-12.el7

Dependency Installed:
 cronie.x86_64 0:1.4.11-17.el7 cronie-anacron.x86_64 0:1.4.11-17.el7 crontabs.noarch 0:1.11-6.20121102git.el7 
 lm_sensors-libs.x86_64 0:3.4.0-4.20160601gitf9185e5.el7 systemd-sysv.x86_64 0:219-42.el7_4.1

 dracut.x86_64 0:033-502.el7

Dependency Updated:
 systemd.x86_64 0:219-42.el7_4.1 systemd-libs.x86_64 0:219-42.el7_4.1


Install sysstat package in Debian/Ubuntu Linux

root@linuxnix:/# apt-get install sysstat
Reading package lists... Done
Building dependency tree
Reading state information... Done
The following extra packages will be installed:
Suggested packages:
lm-sensors isag
The following NEW packages will be installed:
libsensors4 sysstat
0 upgraded, 2 newly installed, 0 to remove and 23 not upgraded.
Need to get 283 kB/310 kB of archives.
After this operation, 1022 kB of additional disk space will be used.
Do you want to continue? [Y/n] y
Get:1 trusty/main sysstat amd64 10.2.0-1 [283 kB]
Fetched 283 kB in 12s (22.8 kB/s)
Preconfiguring packages ...
Selecting previously unselected package libsensors4:amd64.
(Reading database ... 11569 files and directories currently installed.)
Preparing to unpack .../libsensors4_1%3a3.3.4-2ubuntu1_amd64.deb ...
Unpacking libsensors4:amd64 (1:3.3.4-2ubuntu1) ...
Selecting previously unselected package sysstat.
Preparing to unpack .../sysstat_10.2.0-1_amd64.deb ...
Unpacking sysstat (10.2.0-1) ...
Processing triggers for ureadahead (0.100.0-16) ...
Setting up libsensors4:amd64 (1:3.3.4-2ubuntu1) ...
Setting up sysstat (10.2.0-1) ...

Creating config file /etc/default/sysstat with new version
update-alternatives: using /usr/bin/sar.sysstat to provide /usr/bin/sar (sar) in auto mode
Processing triggers for libc-bin (2.19-0ubuntu6.11) ...
Processing triggers for ureadahead (0.100.0-16) ...

We can use sar to measure and report on many aspects of our system metrics, but for this series of articles, we’ll focus on using sar to measure CPU, memory and disk utilization since most performance related issues are usually caused by one or more of these three metrics.

Some of the remarkable data collection and reporting features of sar are as follows:

  • Consolidated utilization statistics for all CPUs on the system or an individual CPU core.
  • Memory utilization including swap space and memory paging operations.
  • Overall and individual I/O operations being performed.
  • Load average report.
  • Context switch statistics.
  • Network utilization statistics.
  • View historical data up to the last month (using sa1 and sa2).
  • Modify formatting of data presentation to other formats using sadf.

The sar command, when running without any options, displays the following information:

  • The hostname of the system on which it’s running
  • The OS/kernel version of the system
  • CPU architecture
  • CPU count
  • Report on CPU statistics from 12 a.m. today till date at an interval of 10 minutes
  • Average CPU utilization reported

SAR will report the hostname, OS/kernel version of the system, CPU architecture and CPU count in its output for any metric we choose to report on.

Here is a sample:

[sahil@linuxnix:~] $ sar
Linux 2.6.32-642.13.1.el6.x86_64 (    10/12/2017      _x86_64_        (2 CPU)
12:00:01 AM     CPU     %user     %nice   %system   %iowait    %steal     %idle
12:10:01 AM     all      1.63      0.00      1.17      0.07      0.00     97.12
12:20:01 AM     all      1.61      0.00      1.14      0.06      0.00     97.19
12:30:01 AM     all      1.57      0.00      1.11      0.06      0.00     97.26
12:40:01 AM     all      1.64      0.00      1.11      0.06      0.00     97.19
12:50:01 AM     all      1.65      0.00      1.14      0.06      0.00     97.15
------------output truncated for brevity
01:00:01 AM     all      1.59      0.00      1.12      0.06      0.00     97.24
01:10:01 AM     all      1.66      0.00      1.15      0.05      0.00     97.14
01:20:01 AM     all      1.64      0.00      1.19      0.06      0.00     97.11
07:00:01 AM     all      1.63      0.00      1.12      0.05      0.00     97.20
07:10:01 AM     all      1.68      0.00      1.19      0.05      0.00     97.07
07:20:01 AM     all      1.70      0.00      1.21      0.32      0.00     96.77
07:30:01 AM     all      1.71      0.00      1.21      0.12      0.00     96.95
07:40:01 AM     all      1.64      0.00      1.15      0.06      0.00     97.14
07:50:01 AM     all      1.59      0.00      1.11      0.06      0.00     97.23
08:00:01 AM     all      1.68      0.00      1.09      0.06      0.00     97.18
Average:        all      2.12      0.12      1.53      0.52      0.00     95.71

[sahil@linuxnix:~] $

The keyword all implies consolidated data for all CPUs that are present on the system (2 CPUs in this example). The output starts from 12:00 a.m. on the current day and continues until the current time rounded to the last 10 minutes since the data is being collected at 10-minute intervals.

We invoke an option/flag while running sar to specify the type of metric we want to report on. In addition to the type of metric, we also specify the number of times the statistics on the metric should be reported and the time gap or interval between successive reports.

The basic syntax of sar command in Linux

sar <option> [interval] [count]

You would be able to get the details on the available options from the sar man page. Now I’ll proceed to discuss reporting metrics for CPU, memory, and disk and also explain the meaning of the various statistics/values being reported as they relate to the parameters.

Before we get to the options here’s a quick example of using interval and count:

[sahil@linuxnix:~] $ sar 1 2
Linux 2.6.32-642.13.1.el6.x86_64 (    10/12/2017      _x86_64_        (2 CPU)
08:20:43 AM     CPU     %user     %nice   %system   %iowait    %steal     %idle
08:20:44 AM     all      0.50      0.00      0.50      0.00      0.00     98.99
08:20:45 AM     all      1.00      0.00      1.00      0.50      0.00     97.50
Average:            all      0.75      0.00      0.75      0.25      0.00     98.25

Sar can be used as a practical server monitoring solution for small or medium environments. We can place scripts to query sar data being reported for different metrics, define certain metric utilization thresholds and configure email alerts or other corrective actions if any limits are found to be breaching.

In the next article, I’ll explain how we use sar to obtain real-time performance data for CPU, memory, disk and I/O metrics.

The following two tabs change content below.

Sahil Suri

He started his career in IT in 2011 as a system administrator. He has since worked with HP-UX, Solaris and Linux operating systems along with exposure to high availability and virtualization solutions. He has a keen interest in shell, Python and Perl scripting and is learning the ropes on AWS cloud, DevOps tools, and methodologies. He enjoys sharing the knowledge he's gained over the years with the rest of the community.