sar

Report I/O and transfer rate issued to physical devices, one per second (press to quit)

$ sar -b [1]

$ sar -n DEV [2] [10]

$ sar -u ALL [2]

$ sar -r ALL [1] [20]

$ sar -q [1]

$ sar -B [5]

sar [options] [interval [count]]
Common examples:
sar -u interval count (CPU usage)
sar -r interval count (Memory usage)
sar -b interval count (I/O statistics)
sar -n DEV interval count (Network device stats)
sar -f filename (Read from saved file)

-u
    Report CPU utilization statistics.

-r
    Report memory and swap space utilization statistics.

-b
    Report I/O and transfer rate statistics.

-d
    Report disk activity statistics (for each disk).

-n {keyword}
    Report network statistics based on keyword (e.g., DEV, IP, TCP).

-w
    Report task creation and context switching statistics.

-q
    Report queue length and load average statistics.

-f {filename}
    Read activity from filename instead of real-time data.

-s {hh:mm:ss}
    Set the start time of data collection.

-e {hh:mm:ss}
    Set the end time of data collection.

-A
    Report all activities (a comprehensive report).

interval
    Time in seconds between each report (for real-time).

count
    Number of reports to display (for real-time).

sar (System Activity Reporter) is a powerful command-line utility used for collecting, reporting, and saving system activity information. It is part of the sysstat package. sar provides a comprehensive overview of system performance metrics, including CPU utilization, memory and swap space usage, disk I/O, network statistics, and much more.

It can display real-time performance data or analyze historical data stored in binary log files, typically located in /var/log/sysstat/. This capability makes sar invaluable for troubleshooting performance bottlenecks, capacity planning, and long-term system monitoring. Administrators often use sar to identify trends, pinpoint periods of high resource consumption, and understand the overall health and behavior of their Linux systems.

sar collects data in a binary format, requiring sar itself for interpretation.
Historical data collection depends on a cron job or systemd timer, usually provided by the sysstat package. Without it, historical data won't be available.
Understanding the detailed metrics requires some system knowledge; outputs can be extensive.
Minimal overhead during data collection, but consider on highly loaded systems.

sar historical data is typically stored in binary files named saDD (e.g., sa01 for the 1st of the month) within /var/log/sysstat/. These files are managed by logrotate or similar services.
To view data from a specific date, use the -f option, for example: sar -f /var/log/sysstat/sa15.

When interval and count are provided (e.g., sar -u 1 5), sar reports real-time data directly from the kernel.
When only options like -f, -s, or -e are used without interval and count, sar reads and analyzes previously collected historical data from log files.

sar is a core component of the sysstat package, tracing its origins back to System V Unix. It has served as a fundamental tool for system administrators for decades. The sysstat project, which maintains and extends sar and related utilities (like iostat, mpstat, pidstat), has been actively developed for Linux by Sebastien Godard since the late 1990s. Its continuous evolution and widespread adoption underscore its lasting importance in Linux performance monitoring.

iostat(1), mpstat(1), vmstat(8), pidstat(1), top(1), free(1)