🔍 Monitor Linux system resources with SAR (System Activity Report)

Once the servers are built and deployed for development or production, etc., the sysadmin’s primary job is to make sure the servers keep running by continuously monitoring resource usage like memory usage, CPU usage, etc., through various utilities.

One such utility that is used to monitor RHEL / CentOS servers is SAR.

🔍 Install Bashtop – Monitor Resources from Terminal for Linux | macOS | FreeBSD

SAR or System Activity Report used to monitor Linux system resources.

It can be used to generate reports related to system performance, i.e. CPU reports, memory reports, disk reports, etc.

🔍 Installing Sensu Go Monitoring Tool on CentOS 8 / RHEL 8

It stores reports as logs on your system.

In this guide, we will learn about system resource monitoring with SAR with some examples, but first, we will install SAR in our system.

🔍 Install and configure Checkmk on CentOS 8 and monitor Linux hosts using Checkmk agent


The SYSSTAT package is required to install the SAR utility on a system. To install sysstat, run:

$ yum install sysstat

Now start and enable the sysstat service to start using SAR,

$ systemctl start sysstat $ systemctl enable sysstat

After activating the service, log files for the current day will be created in the “/ var / log / sa” folder in the “sa15” file, where 15 is the current date.

Older files will be archived.

We can also change the number of days for which we will keep our log files by changing the “HISTORY” parameter in the sysstat configuration file, for example, “/ etc / sysconfig / sysstat”.

SAR utility syntax

The syntax for using sar is:

$ sar option interval (in seconds) number of records

An example would be:

$ sar 2 5

In this example, sar will provide a report generated at 2 second intervals with a total of 5 records.

Generating a CPU report

Sar command to generate CPU report:

$ sar -u 2 5

Generating a memory report The parameter used with sar to generate a memory report is “-r”

$ sar -r 2 5

Generating device statistics

The option to generate a device report is “-d” and it is used with “-p” to make the report in a readable format,

$ sar -d -p 2 5

Generating a SWAP Usage Report

Ability to generate a SWAp memory report for the system – “-S”,

$ sar S 2 5

Generating System I / O Activity

To check the I / O activity of the whole system, use the option used with sar – “-b”

$ sar -b 2 5

To view network statistics

To check the network statistics of the system, select the “-n” option, but it is used with a keyword, or we can use “ALL” instead of a specific keyword to view all network statistics.

$ sar –n ‘Keyword’ (or ‘ALL’)

The keywords can be different, depending on your needs:

  • DEV – for network interface statistics,
  • EDEV – displays statistics of network device failures
  • IP – for IPv4 network traffic
  • EIP – for IPv4 network errors
  • ICMP – for ICMPv4 network traffic
  • EICMP – for ICMPv4 network errors
  • TCP – for TCPv4 network traffic
  • ETCP – for TCPv4 network errors
  • UDP – for UDPv4 network traffic
  • NFS – for NFS client actions
  • NFSD – for NFS server activity
  • SOCK – for sockets used for IPv4 SOCK6, IP6, EIP6, ICMP6, UDP6 for IPv6

Note. When used as a parameter “ALL”, reports can be very long.

We can also save the output of any sar command to a file using the ‘-o’ options.

$ sar –r 2 4 –o / home / log

Where / home / log is the location of the file.

These were some examples that are used to monitor Linux system resources with SAR. For inquiries / questions use the comment box below.