sar

Report I/O and transfer rate issued to physical devices, one per second (press to quit)

$ sar -b [1]

$ sar -n DEV [2] [10]

$ sar -u ALL [2]

$ sar -r ALL [1] [20]

$ sar -q [1]

$ sar -B [5]

sar [ options ] [ interval [ count ] ]

-A
    Report all activities.

-b
    Report I/O and transfer rate statistics.

-B
    Report paging statistics.

-c
    Report process creation activity.

-d
    Report block device activity.

-F [ ALL ]
    Display statistics for currently mounted filesystems. Add ALL keyword to also report statistics on disk partitions, virtual devices and NFS filesystems.

-H
    Show large numbers in human-readable format (e.g., 1K, 234M, 2G).

-I { int | SUM | ALL }
    Report statistics for a specific interrupt. Use SUM to display the total number of interrupts received per second. Use ALL to report statistics for each interrupt.

-m
    Report power management statistics.

-n { DEV | EDEV | NFS | NFSD | SOCK | ALL }
    Report network statistics. DEV reports network device statistics, EDEV reports network device error statistics, NFS reports NFS client activity, NFSD reports NFS server activity, SOCK reports socket usage, and ALL reports all network statistics.

-p
    Report statistics for each process (requires a Linux kernel version 2.6.18 or later).

-q
    Report queue length and load averages.

-r
    Report memory usage statistics.

-R
    Report memory statistics in real-time.

-S
    Report swap space utilization statistics.

-t
    Display timestamp in the report.

-u [ ALL ]
    Report CPU utilization. ALL includes additional CPU statistics.

-v
    Report inode, file, and other kernel table status.

-V
    Print version number and exit.

-w
    Report task creation and system switching activity.

-x { pid | SELF | ALL }
    Report statistics for a specific process ID (pid). SELF refers to the sar process. ALL displays statistics for all processes.

-y
    Report TTY device activity.

-z
    Suppress output of reports with zero values.

interval
    Sampling interval in seconds.

count
    Number of times to sample.

The sar command in Linux is a powerful system activity reporter. It collects, reports, and saves system activity information, providing insights into resource utilization. This allows administrators to monitor performance bottlenecks, troubleshoot issues, and plan for capacity. sar can report on CPU utilization, memory usage, disk I/O, network activity, process creation, and more.
The command operates in two primary modes: real-time reporting and historical data analysis. In real-time mode, sar gathers and displays system activity data at specified intervals. In historical mode, it reads previously saved data from files generated by sar running in the background, typically via cron jobs. These historical reports are invaluable for identifying trends and anomalies over time.
The utility is part of the sysstat package and relies on the kernel providing the necessary statistics via the /proc filesystem. Interpreting sar output requires understanding the various metrics reported, but it provides invaluable insights into system behavior for performance tuning and troubleshooting.

sar relies on the sysstat package being installed and properly configured. Historical data collection requires cron jobs to be set up. Interpreting the output requires knowledge of the various system performance metrics. Results may vary depending on the kernel version and system configuration.

Historical data is typically stored in binary files in the /var/log/sa directory. These files are named saDD, where DD is the day of the month. The sadc utility is used to collect and store the data.

A typical crontab entry for daily data collection is similar to this:
0 * * * * /usr/lib64/sa/sa1 1 1
This will run every hour and collect the system statistics.

In the CPU utilization report, the %idle metric represents the percentage of time the CPU was idle. A consistently low %idle can indicate CPU saturation and the need for further investigation.

sar has been a part of the Unix and Linux ecosystem for many years. It evolved from earlier system monitoring tools and has been continuously improved with new features and expanded reporting capabilities. Its widespread use has made it a standard tool for system administrators.

vmstat(8), iostat(1), mpstat(1), pidstat(1)