sar.sysstat

sar [options] [interval [count]]

-A
    Reports all activities currently available. This is equivalent to specifying all available options.

-b
    Reports I/O and transfer rate statistics.

-B
    Reports paging statistics.

-d
    Reports activity for each block device (e.g., disk I/O).

-f
    Reads data from the specified filename. This is used for historical data analysis.

-H
    Reports hugepages utilization statistics.

-n {keyword}
    Reports network statistics. Common keywords include DEV (interface statistics), EDEV (error statistics), SOCK (sockets), IP, TCP, UDP, etc.

-o
    Saves the collected data in binary format to the specified filename.

-q
    Reports queue length and load averages.

-r
    Reports memory utilization statistics (e.g., used, free, buffers, cached).

-u
    Reports CPU utilization. This is the default activity reported if no option is specified.

-v
    Reports inode, file, and other kernel tables statistics.

-w
    Reports task creation and context switching statistics.

-W
    Reports swap statistics (e.g., pages swapped in/out).

interval
    The time in seconds between each report.

count
    The number of reports to display. If not specified, sar reports continuously.

The sar (System Activity Reporter) command, part of the sysstat package, is a powerful utility for collecting, reporting, and saving system activity information. It is indispensable for system administrators to monitor performance, identify bottlenecks, and troubleshoot issues.

sar gathers data on various system resources such as CPU utilization, memory usage, I/O activity, network statistics, process creation, and more. It provides both real-time insights and the capability for historical data analysis. Its high configurability allows users to specify sampling intervals and the number of samples, or to read from previously saved data files, making it a versatile tool for comprehensive system performance analysis on Linux and Unix-like operating systems.

Using sar effectively requires the sysstat package to be installed on the system.

Interpreting the vast amount of data sar provides requires a good understanding of system metrics and performance indicators. While powerful, collecting data at very small intervals (e.g., less than 1 second) can introduce a slight overhead, especially on systems already under heavy load. Historical data logging and rotation are typically managed by cron jobs invoking the associated sa1 and sa2 scripts.

sar can be used for immediate, real-time performance monitoring. For example, sar -u 1 5 will display CPU utilization every 1 second for 5 times, providing a quick snapshot of current system activity.

By default on many distributions, sar logs daily activity data to files (typically in /var/log/sysstat/ or /var/log/sa/ directories, named saXX where XX is the day of the month). This historical data can be viewed using the -f option (e.g., sar -f /var/log/sysstat/sa01), enabling post-mortem analysis of performance trends and issues over time.

sar is a fundamental utility within the sysstat project, which has been under continuous development for Linux since the late 1990s. It originated from similar system monitoring tools found in proprietary Unix systems. Over time, it has evolved into a robust and indispensable tool for system performance analysis and capacity planning across various Linux distributions.

iostat(1), mpstat(1), vmstat(8), pidstat(1), sadc(8), sa1(8), sa2(8)