SAR(1) | Linux User's Manual | SAR(1) |
sar - Collect, report, or save system activity information.
sar [ -A ] [ -B ] [ -b ] [ -C ] [ -D ] [ -d ] [ -F [ MOUNT ] ] [ -H ] [ -h ] [ -p ] [ -q ] [ -r [ ALL ] ] [ -S ] [ -t ] [ -u [ ALL ] ] [ -V ] [ -v ] [ -W ] [ -w ] [ -y ] [ -z ] [ --dec={ 0 | 1 | 2 } ] [ --dev= dev_list ] [ --fs= fs_list ] [ --help ] [ --human ] [ --iface= iface_list ] [ --sadc ] [ -I { int_list | SUM | ALL } ] [ -P { cpu_list | ALL } ] [ -m { keyword [,...] | ALL } ] [ -n { keyword [,...] | ALL } ] [ -j { ID | LABEL | PATH | UUID | ... } ] [ -f [ filename ] | -o [ filename ] | -[0-9]+ ] [ -i interval ] [ -s [ hh:mm[:ss] ] ] [ -e [ hh:mm[:ss] ] ] [ interval [ count ] ]
The sar command writes to standard output the contents of selected cumulative activity counters in the operating system. The accounting system, based on the values in the count and interval parameters, writes information the specified number of times spaced at the specified intervals in seconds. If the interval parameter is set to zero, the sar command displays the average statistics for the time since the system was started. If the interval parameter is specified without the count parameter, then reports are generated continuously. The collected data can also be saved in the file specified by the -o filename flag, in addition to being displayed onto the screen. If filename is omitted, sar uses the standard system activity daily data file (see below). By default all the data available from the kernel are saved in the data file.
The sar command extracts and writes to standard output records previously saved in a file. This file can be either the one specified by the -f flag or, by default, the standard system activity daily data file. It is also possible to enter -1, -2 etc. as an argument to sar to display data of that days ago. For example, -1 will point at the standard system activity file of yesterday.
Standard system activity daily data files are named saDD or saYYYYMMDD, where YYYY stands for the current year, MM for the current month and DD for the current day. They are the default files used by sar only when no filename has been explicitly specified. When used to write data to files (with its option -o), sar will use saYYYYMMDD if option -D has also been specified, else it will use saDD. When used to display the records previously saved in a file, sar will look for the most recent of saDD and saYYYYMMDD, and use it.
Standard system activity daily data files are located in the /var/log/sysstat directory by default. Yet it is possible to specify an alternate location for them: If a directory (instead of a plain file) is used with options -f or -o then it will be considered as the directory containing the data files.
Without the -P flag, the sar command reports system-wide (global among all processors) statistics, which are calculated as averages for values expressed as percentages, and as sums otherwise. If the -P flag is given, the sar command reports activity which relates to the specified processor or processors. If -P ALL is given, the sar command reports statistics for each individual processor and global statistics among all processors. Offline processors are not displayed.
You can select information about specific system activities using flags. Not specifying any flags selects only CPU activity. Specifying the -A flag selects all possible activities.
The default version of the sar command (CPU utilization report) might be one of the first facilities the user runs to begin system activity investigation, because it monitors major system resources. If CPU utilization is near 100 percent (user + nice + system), the workload sampled is CPU-bound.
If multiple samples and multiple reports are desired, it is convenient to specify an output file for the sar command. Run the sar command as a background process. The syntax for this is:
sar -o datafile interval count >/dev/null 2>&1 &
All data are captured in binary form and saved to a file (datafile). The data can then be selectively displayed with the sar command using the -f option. Set the interval and count parameters to select count records at interval second intervals. If the count parameter is not set, all the records saved in the file will be selected. Collection of data in this manner is useful to characterize system usage over a period of time and determine peak usage hours.
Note: The sar command only reports on local activities.
pgpgin/s
pgpgout/s
fault/s
majflt/s
pgfree/s
pgscank/s
pgscand/s
pgsteal/s
%vmeff
tps
rtps
wtps
bread/s
bwrtn/s
tps
rkB/s
wkB/s
areq-sz
aqu-sz
await
svctm
%util
The following values are displayed:
MBfsfree
MBfsused
%fsused
%ufsused
Ifree
Iused
%Iused
kbhugfree
kbhugused
%hugused
Possible keywords are CPU, FAN, FREQ, IN, TEMP and USB.
With the CPU keyword, statistics about CPU are reported. The following value is displayed:
MHz
With the FAN keyword, statistics about fans speed are reported. The following values are displayed:
rpm
drpm
DEVICE
With the FREQ keyword, statistics about CPU clock frequency are reported. The following value is displayed:
wghMHz
With the IN keyword, statistics about voltage inputs are reported. The following values are displayed:
inV
%in
DEVICE
With the TEMP keyword, statistics about devices temperature are reported. The following values are displayed:
degC
%temp
DEVICE
With the USB keyword, the sar command takes a snapshot of all the USB devices currently plugged into the system. At the end of the report, sar will display a summary of all those USB devices. The following values are displayed:
BUS
idvendor
idprod
maxpower
manufact
product
The ALL keyword is equivalent to specifying all the keywords above and therefore all the power management statistics are reported.
Possible keywords are DEV, EDEV, FC, ICMP, EICMP, ICMP6, EICMP6, IP, EIP, IP6, EIP6, NFS, NFSD, SOCK, SOCK6, SOFT, TCP, ETCP, UDP and UDP6.
With the DEV keyword, statistics from the network devices are reported. Statistics for all network interfaces are displayed unless a restricted list is specified using option --iface= (see corresponding option entry). The following values are displayed:
IFACE
rxpck/s
txpck/s
rxkB/s
txkB/s
rxcmp/s
txcmp/s
rxmcst/s
%ifutil
With the EDEV keyword, statistics on failures (errors) from the network devices are reported. Statistics for all network interfaces are displayed unless a restricted list is specified using option --iface= (see corresponding option entry). The following values are displayed:
IFACE
rxerr/s
txerr/s
coll/s
rxdrop/s
txdrop/s
txcarr/s
rxfram/s
rxfifo/s
txfifo/s
With the FC keyword, statistics about fibre channel traffic are reported. Note that fibre channel statistics depend on sadc's option "-S DISK" to be collected. The following values are displayed:
FCHOST
fch_rxf/s
fch_txf/s
fch_rxw/s
fch_txw/s
With the ICMP keyword, statistics about ICMPv4 network traffic are reported. Note that ICMPv4 statistics depend on sadc's option "-S SNMP" to be collected. The following values are displayed (formal SNMP names between square brackets):
imsg/s
omsg/s
iech/s
iechr/s
oech/s
oechr/s
itm/s
itmr/s
otm/s
otmr/s
iadrmk/s
iadrmkr/s
oadrmk/s
oadrmkr/s
With the EICMP keyword, statistics about ICMPv4 error messages are reported. Note that ICMPv4 statistics depend on sadc's option "-S SNMP" to be collected. The following values are displayed (formal SNMP names between square brackets):
ierr/s
oerr/s
idstunr/s
odstunr/s
itmex/s
otmex/s
iparmpb/s
oparmpb/s
isrcq/s
osrcq/s
iredir/s
oredir/s
With the ICMP6 keyword, statistics about ICMPv6 network traffic are reported. Note that ICMPv6 statistics depend on sadc's option "-S IPV6" to be collected. The following values are displayed (formal SNMP names between square brackets):
imsg6/s
omsg6/s
iech6/s
iechr6/s
oechr6/s
igmbq6/s
igmbr6/s
ogmbr6/s
igmbrd6/s
ogmbrd6/s
irtsol6/s
ortsol6/s
irtad6/s
inbsol6/s
onbsol6/s
inbad6/s
onbad6/s
With the EICMP6 keyword, statistics about ICMPv6 error messages are reported. Note that ICMPv6 statistics depend on sadc's option "-S IPV6" to be collected. The following values are displayed (formal SNMP names between square brackets):
ierr6/s
idtunr6/s
odtunr6/s
itmex6/s
otmex6/s
iprmpb6/s
oprmpb6/s
iredir6/s
oredir6/s
ipck2b6/s
opck2b6/s
With the IP keyword, statistics about IPv4 network traffic are reported. Note that IPv4 statistics depend on sadc's option "-S SNMP" to be collected. The following values are displayed (formal SNMP names between square brackets):
irec/s
fwddgm/s
idel/s
orq/s
asmrq/s
asmok/s
fragok/s
fragcrt/s
With the EIP keyword, statistics about IPv4 network errors are reported. Note that IPv4 statistics depend on sadc's option "-S SNMP" to be collected. The following values are displayed (formal SNMP names between square brackets):
ihdrerr/s
iadrerr/s
iukwnpr/s
idisc/s
odisc/s
onort/s
asmf/s
fragf/s
With the IP6 keyword, statistics about IPv6 network traffic are reported. Note that IPv6 statistics depend on sadc's option "-S IPV6" to be collected. The following values are displayed (formal SNMP names between square brackets):
irec6/s
fwddgm6/s
idel6/s
orq6/s
asmrq6/s
asmok6/s
imcpck6/s
omcpck6/s
fragok6/s
fragcr6/s
With the EIP6 keyword, statistics about IPv6 network errors are reported. Note that IPv6 statistics depend on sadc's option "-S IPV6" to be collected. The following values are displayed (formal SNMP names between square brackets):
ihdrer6/s
iadrer6/s
iukwnp6/s
i2big6/s
idisc6/s
odisc6/s
inort6/s
onort6/s
asmf6/s
fragf6/s
itrpck6/s
With the NFS keyword, statistics about NFS client activity are reported. The following values are displayed:
call/s
retrans/s
read/s
write/s
access/s
getatt/s
With the NFSD keyword, statistics about NFS server activity are reported. The following values are displayed:
scall/s
badcall/s
packet/s
udp/s
tcp/s
hit/s
miss/s
sread/s
swrite/s
saccess/s
sgetatt/s
With the SOCK keyword, statistics on sockets in use are reported (IPv4). The following values are displayed:
totsck
tcpsck
udpsck
rawsck
ip-frag
tcp-tw
With the SOCK6 keyword, statistics on sockets in use are reported (IPv6). Note that IPv6 statistics depend on sadc's option "-S IPV6" to be collected. The following values are displayed:
tcp6sck
udp6sck
raw6sck
ip6-frag
With the SOFT keyword, statistics about software-based network processing are reported. The following values are displayed:
total/s
dropd/s
squeezd/s
rx_rps/s
flw_lim/s
With the TCP keyword, statistics about TCPv4 network traffic are reported. Note that TCPv4 statistics depend on sadc's option "-S SNMP" to be collected. The following values are displayed (formal SNMP names between square brackets):
active/s
passive/s
iseg/s
oseg/s
With the ETCP keyword, statistics about TCPv4 network errors are reported. Note that TCPv4 statistics depend on sadc's option "-S SNMP" to be collected. The following values are displayed (formal SNMP names between square brackets):
atmptf/s
estres/s
retrans/s
isegerr/s
orsts/s
With the UDP keyword, statistics about UDPv4 network traffic are reported. Note that UDPv4 statistics depend on sadc's option "-S SNMP" to be collected. The following values are displayed (formal SNMP names between square brackets):
idgm/s
odgm/s
noport/s
idgmerr/s
With the UDP6 keyword, statistics about UDPv6 network traffic are reported. Note that UDPv6 statistics depend on sadc's option "-S IPV6" to be collected. The following values are displayed (formal SNMP names between square brackets):
idgm6/s
odgm6/s
noport6/s
idgmer6/s
The ALL keyword is equivalent to specifying all the keywords above and therefore all the network activities are reported.
runq-sz
plist-sz
ldavg-1
ldavg-5
ldavg-15
blocked
kbmemfree
kbavail
kbmemused
%memused
kbbuffers
kbcached
kbcommit
%commit
kbactive
kbinact
kbdirty
kbanonpg
kbslab
kbkstack
kbpgtbl
kbvmused
kbswpfree
kbswpused
%swpused
kbswpcad
%swpcad
%user
%usr
%nice
%system
%sys
%iowait
%steal
%irq
%soft
%guest
%gnice
%idle
dentunusd
file-nr
inode-nr
pty-nr
pswpin/s
pswpout/s
proc/s
cswch/s
rcvin/s
xmtin/s
framerr/s
prtyerr/s
brk/s
ovrun/s
The sar command takes into account the following environment variables:
Note: On Debian sysstems the colors are displayed by default when output is connected to the terminal, even if this variable is not set (i.e. unset variable is treated as if it were set to auto).
Please note that the color (being red, yellow, or some other color) used to display a value is not indicative of any kind of issue simply because of the color. It only indicates different ranges of values.
sar -u 2 5
sar -I 14 -o int14.file 2 10
sar -r -n DEV -f /var/log/sysstat/sa16
sar -A
/proc filesystem must be mounted for the sar command to work.
All the statistics are not necessarily available, depending on the kernel version used. sar assumes that you are using at least a 2.6 kernel.
/var/log/sysstat/saDD
/var/log/sysstat/saYYYYMMDD
Sebastien Godard (sysstat <at> orange.fr)
sadc(8), sa1(8), sa2(8), sadf(1), sysstat(5), pidstat(1), mpstat(1), iostat(1), vmstat(8)
https://github.com/sysstat/sysstat
http://pagesperso-orange.fr/sebastien.godard/
OCTOBER 2018 | Linux |