Sar command example in Linux

The Sar command is one of the very useful tools used by any Linux administrator to monitor system performance and investigate bottlenecks. This tool is provided by the sysstat package and can be used to find various resource usage including CPU, memory, swap, load average over time.

In this article, we will introduce various ways of using the “sar” command. This command collects system data and stores it in the file “/ var / log / sa / sadd” (where dd is the corresponding date in the month). The file contains binary data, so you will not be able to read the file directly. You can use the “sar” command to read data from the “/ var / log / sa / sadd” file.

Install the Sysstat utility

On Centos

You can get the “sar” command by installing the sysstat package. You can follow the instructions below to install using the yum package manager.

$ sudo yum install sysstat

By default, sysstat stores server statistics in the file “/ var / log / sa / sadd” and retains the data for 7 days. If you want to retain more data, you need to modify the sysstat configuration file “/ etc / sysconfig / sysstat”.

#Cat / etc / sysconfig / sysstat # How long (days) to keep log files, up to one month HISTORY = 7

Modify the value of HISTORY with the number of days you want to keep the log.

On Ubuntu

Installing the command line tool sar is easy, it is part of the sysstat package. So, type the following in Ubuntu:

$ sudo apt install sysstat

Next, we need to enable it.

Edit the following files on Ubuntu. No centos needed.

$ sudo nano /etc/default/sysstat

And set ENABLED to true


On Fedora

By default, Fedora 21’s sysstat comes with it, all you need to do is run under the following command

$sudo systemctl enable sysstat.service
$sudo systemctl start sysstat.service

sysstat has a cron job that runs every 10 minutes to collect data and store it in the corresponding file (/ var / log / sa / sadd). If you want to change the interval at which this cron runs, you can modify it in “/etc/cron.d/sysstat”. For systemd, the timer unit file calls sysstat-collect.service (/usr/lib/systemd/system/sysstat-collect.service) every 10 minutes to collect statistics.

#Cat /etc/cron.d/sysstat# Run the system activity accounting tool every 10 minutes * / 10 * * * * root / usr / lib / sa / sa1 1 1 #Generate process accounting summary 23:53 every day 23 * * * Root / usr / lib / sa / sa2 –A

sar command usage

The basic syntax of the “sar” command usage is as follows.

Sal [option] [-o filename] [-f filename] [interval] [count]

1) Find CPU activity

By default (no other options are provided), the sar command will report the server’s CPU activity. In addition, the option “-u” can be used to get a CPU usage report. If you want to get the CPU activity report 3 times every 2 seconds, you can use the following command.

#Sar -u 2 3 Linux 2.6.18-274.18.1.el5 (myserver) June 6, 2012 CPU% user% nice% system% iowait% steal% idle 03:15:47 PM all 7.75 0.00 0.81 0.44 0.00 91.01 03:15:49 PM all 12.23 0.00 3.81 5.49 0.00 78.48 03:15:51 PM all 1.19 0.00 0.56 0.31 0.00 97.94 average: all 7.06 0.00 1.73 2.08 0.00 89.13

%user Represents the percentage of CPU utilization that occurred during user level (application) execution, %system Represents the percentage of CPU utilization that occurred at the system level (kernel) execution. %idle Is the percentage of time that one or more CPUs are idle and the system has no outstanding disk I / O requests.

If you want to get the output in a file, you need to append –o filename to the command. In addition, you can get the CPU activity report for a specific date (for example, September 5, 2012), you can find it as:

sar –u –f / var / log / sa / sa05

2) Find the CPU usage of each processor

The -u switch provides CPU usage on all processors. If you want to find CPU activity on all processors separately, you need to use the –P switch.

root @ hos [~]#Sar -P ALL 1 1 Linux 2.6.18-274.18.1.el5 (myserver) 2012/09/06 03:22:52 PM CPU% user% nice% system% iowait% steal% idle 03:22:53 PM All 0.88 0.00 0.50 0.75 0.00 97.88 03:22:53 PM 0 0.00 0.00 0.00 0.00 0.00 0.00 100.00 03:22:53 PM 1 0.00 0.00 0.00 0.00 0.00 0.00 10 0.00 03:22:53 PM 2 0.99 0.00 0.00 0.99 0.00 98.02 03:22 : 53 pm 3 1.00 0.00 1.00 2.00 0.00 96.00 ……

3) Find memory usage

You can use the “-r” switch to find the memory usage (used and available memory of the server) over time.

#Sar -r 1 3 Linux 2.6.18-274.18.1.el5 (myserver) 09/06/2012 03:26:28 PM kbmemfree kbmemused% memused kbbuffers kbcached kbswpfree kbswpused% swpused kbswpcad 03:26:29 PM 472260 3666564 88.59 440624 1976800 1565920 530520 25.31 276336 03:26:30 PM 471268 3667556 88.61 440648 1976560 1566100 530340 25.30 276240 03:26:31 PM 470524 3668300 88.63 440672 1976824 1566212 530228 25.29 276216 Average: 471351 3667473 1976 1728100

Kbmemfree Display the amount of free memory available (in kilobytes), kbmemused Shows the amount of used memory in kilobytes. This does not take into account the memory used by the kernel itself.

If you want to collect memory usage for a certain day (such as Sep 05), you need to run it in the following way:

sar –r –f / var / log / sa / sa05

4) Find exchange activities

You can use the “-W” option to check the machine’s exchange statistics.

#Sar -W 1 3 Linux 2.6.18-274.18.1.el5 (myserver) September 6, 2012 pswpin / s pswpout / s 03:31:13 PM 16.16 0.00 03:31:14 PM 16.00 0.00 03:31 : 15 PM 15.84 0.00Average: 16.00 0.00

pswpin / second Indicates the total number of swap pages introduced by the system per second, and pswpout / second Shows the total number of swap pages brought out by the system per second.

If you want to collect swap usage for a specific date (e.g. September 5th), you need to run it in the following way,

sar –W –f / var / log / sa / sa05

5) Find the average load over time

You can use the –q switch to find the average overtime.

sar -q 1 3 Linux 2.6.18-274.18.1.el5 (myserver) September 6, 2012

03:35:49 PM runq-sz plist-sz ldavg-1 ldavg-5 ldavg-15 03:35:50 PM 0 587 0.70 0.85 0.94 03:35:51 PM 0 587 0.70 0.85 0.94 03:35:52 PM 0 587 0.70 0.85 0.94 Average: 0587 0.70 0.85 0.94

Run q-sz : It shows rRun queue length (number of tasks waiting for run time).plist-sz : Displays the number of tasks in the task list.ldavg-1 / 5/15 : The average system load for the last 1 minute / past 5 minutes / past 15 minutes.

If you want to collect the average load for a specific date, such as September 5th, you need to run as follows:

sar –q –f / var / log / sa / sa05

6) Check the CPU bottleneck

You can use the sar command to find out the interrupt number that may cause a CPU bottleneck. In the example below, # 9 is the highest, excluding system interrupt # 0.

#Sar -I XALL 2 10 02:07:10 AM INTR intr / s 02:07:12 AM 0 992.57 02:07:12 AM 1 0.00 02:07:12 AM 2 0.00 02:07:12 AM 3 0.00 02 : 07: 12 AM 4 0.00 02:07:12 AM 5 0.00 02:07:12 AM 6 0.00 02:07:12 AM 7 0.00 02:07:12 AM 8 0.00 02:07:12 AM 9 350.50

The details in the / proc / interrupts file will also help you. Interrupts suspend processing so that I / O or other operations can be performed. Processing will resume after a specific operation is performed. Therefore, it is very important that each device installed in the machine be provided with an interrupt setting that does not conflict with the settings used by the hardware and other peripherals.

#Cat / proc / interrupts CPU0 0: 3882853 XT-PIC timer 1: 134 XT-PIC i8042 2: 0 XT-PIC cascade 8: 1 XT-PIC rtc 9: 0 XT-PIC uhci_hcd 10: 4397 XT-PIC eth0 11: 46 XT-PIC ioc0 12: 1707 XT-PIC i8042 14: 340596 XT-PIC ide0 15: 63972 XT-PIC ide1 NMI: 0 LOC: 3883128 ERR: 0 MIS: 0

The first column is the IRQ number. The next column reports the type of interrupt, and the last column contains the name of the device located at the IRQ. Glad to read on the linux vmstat command-a tool that can also report virtual memory statistics.

Sar chart-install ksar (Java based GUI)

Installing ksar on top of it is also easy. We need java as a dependency.

sudo apt install openjdk-11-jdk

Or on CentOS

sudo yum install epel-release
sudo yum install java-openjdk

Download ksar and unzip it:


mv download


Now cd into dir

cd kSar-*

Now make the file executable and run as root.

chmod +x

sudo su


Now we can test by running local commands. We go to Data> Run Local Command and then we can use the default command.

ksar run command

Next, we can view these graphics by clicking on the left panel and viewing the displayed graphics on the right:

Tsar looking at the picture

You can also load graphics from a file. First, we need to run sar:

LC_ALL=C sar -A > /tmp/

Then in the menu, select Data> Load from Text File and locate the file at / tmp or where you saved the file.

There is also a way to run remote commands via SSH on other computers. The remote computer must be configured with sar, but ksar is not required. Installing kSar on your local computer is sufficient. To run SSH commands in the menu, select Data> Start SSH Command. Then enter root @ adress, where “address” is the FQDN or IP of the computer. It is localhost by default.

Also read:

  • CPU bottlenecks-how to use Vmstat, Mpstat and SAR commands
  • How to use the BCC kernel trace tool for Linux performance analysis
  • Amazing! 25 Linux performance monitoring tools
  • 10 Linux iostat commands to report CPU and I / O statistics