20 sar command examples in Linux [Cheat Sheet]


CheatSheet

Reviewer: Deepak Prasad

Introduction to sar command

sar is the short form for System Activity Report. sar collects, reports, or saves system activity information like CPU utilization, memory usage, I/O devices usage in the Linux system. sar command displays the average statistics for the time since the system was started. It generates the report in the output, which can also be saved in the file.

 

How to install sar in Linux

If sar is not already installed in the system, you can use the following command to install it.

Install sar on CentOS, Fedora and RHEL, Rocky Linux, Alma Linux

$ sudo yum install sysstat

Install sar on Ubuntu, Debian, and Linux Mint

$ sudo apt install sysstat

 

How to enable sar for collecting system activity

After installing sysstat, you need to enable sar service to collect system activity information. You can do this by editing the file /etc/default/sysstat. Use any of the text editors and replace the line (ENABLED="false") with "true" like below. Then press Ctrl+X to exit and save file.

enable sar service

It will enable sar command to collect system activity information.

NOTE:
The configuration file on CentOS and related Linux variants will be inside /etc/sysconfig/sysstat

After that, you need to restart the sar service using the following command.

$ systemctl restart sysstat.service

 

Configure cron job for sar command

sar is by default configured to collect system statistics for all the resource i.e. CPU, network, memory, disk etc at an interval of 10 minutes. We also have a cron job to create a summary of all the statistics in the midnight for every day.
To get the details of cron job configured by sar you can check /etc/cron.d/sysstat:

~]# cat /etc/cron.d/sysstat 
# Run system activity accounting tool every 10 minutes
*/10 * * * * root /usr/lib64/sa/sa1 1 1
# 0 * * * * root /usr/lib64/sa/sa1 600 6 &
# Generate a daily summary of process accounting at 23:53
53 23 * * * root /usr/lib64/sa/sa2 -A

You can further modify the cron job based on your requirement. The report files are by default stored under /var/log/sa or /var/log/sysstat depending upon your distribution:

~]# ls -l /var/log/sa/sa*
-rw-r-----. 1 root root 2530400 Nov  1 23:50 /var/log/sa/sa01
-rw-r-----. 1 root root 2530400 Nov  2 23:50 /var/log/sa/sa02
-rw-r-----. 1 root root 2530400 Nov  3 23:50 /var/log/sa/sa03
-rw-r-----. 1 root root 2530400 Nov  4 23:50 /var/log/sa/sa04
-rw-r-----. 1 root root 2530400 Nov  5 23:50 /var/log/sa/sa05
-rw-r-----. 1 root root 2530400 Nov  6 23:50 /var/log/sa/sa06
...

These report files are in compressed format and you can use sar -f <file> to read the content of individual files.

 

Different examples to use sar command

The general syntax of sar command is:

$ sar [option] [interval] [count]

Now, let's have a look at some practical examples of sar command in Linux system.

 

1. Display CPU utilization statistics with sar command

-u option is used to display the CPU utilization report. The ALL keyword indicates that all the CPU fields should be displayed.

$ sar -u [ALL]

Sample Output:

~]# sar -u
Linux 4.18.0-193.19.1.2009211817.el7_8.emrs.altmvl.x86_64 (fi-758-ncs20fp2-5-cluster-01-cs-01) 	11/07/2021 	_x86_64_	(16 CPU)

12:00:01 AM     CPU     %user     %nice   %system   %iowait    %steal     %idle
12:10:01 AM     all      4.44      0.00      2.52      0.88      0.00     92.17
12:20:01 AM     all      4.46      0.00      2.54      0.88      0.00     92.11
12:30:01 AM     all      4.46      0.00      2.53      0.88      0.00     92.13
12:40:01 AM     all      4.48      0.00      2.54      0.87      0.00     92.10
12:50:01 AM     all      4.49      0.00      2.55      0.88      0.00     92.07

~]# sar -u ALL
Linux 4.18.0-193.19.1.2009211817.el7_8.emrs.altmvl.x86_64 (fi-758-ncs20fp2-5-cluster-01-cs-01) 	11/07/2021 	_x86_64_	(16 CPU)

12:00:01 AM     CPU      %usr     %nice      %sys   %iowait    %steal      %irq     %soft    %guest    %gnice     %idle
12:10:01 AM     all      4.44      0.00      1.84      0.88      0.00      0.33      0.34      0.00      0.00     92.17
12:20:01 AM     all      4.46      0.00      1.87      0.88      0.00      0.33      0.34      0.00      0.00     92.11
12:30:01 AM     all      4.46      0.00      1.85      0.88      0.00      0.33      0.34      0.00      0.00     92.13
12:40:01 AM     all      4.48      0.00      1.87      0.87      0.00      0.33      0.34      0.00      0.00     92.10
12:50:01 AM     all      4.49      0.00      1.87      0.88      0.00      0.34      0.35      0.00      0.00     92.07
01:00:01 AM     all      4.53      0.00      1.86      0.89      0.00      0.33      0.34      0.00      0.00     92.05

 

2. sar command to report CPU utilization for each N seconds

The following syntax can be used to display CPU utilization statistics for every N seconds.

$ sar -u N

Sample Output:

For example, the following command reports CPU utilization for every 2 seconds. It reports continuously until the command is terminated.

sar command to report CPU utilization for every 2 seconds

 

3. sar command to display memory utilization statistics

You can use -r option to view the memory utilization report with sar command. The ALL keyword displays all the memory fields in the output.

$ sar -r [ALL]

Sample Output:

~]# sar -r
Linux 4.18.0-193.19.1.2009211817.el7_8.emrs.altmvl.x86_64 (fi-758-ncs20fp2-5-cluster-01-cs-01) 	11/07/2021 	_x86_64_	(16 CPU)

12:00:01 AM kbmemfree kbmemused  %memused kbbuffers  kbcached  kbcommit   %commit  kbactive   kbinact   kbdirty
12:10:01 AM   2134156  63566948     96.75   1052256  49162336  40967324     62.35  25409548  34574092       552
12:20:01 AM   2195820  63505284     96.66   1052288  49126936  41028268     62.45  25386316  34535556       372
12:30:01 AM   2169852  63531252     96.70   1052324  49145412  41218496     62.74  25393140  34553428       596
12:40:01 AM   2279420  63421684     96.53   1052348  49111368  41170352     62.66  25319580  34518992       404

 

4. Display I/O and transfer rate statistics using sar command

-b option is used to report I/O and transfer rate statistics.

$ sar -b

Sample Output:

sar command to report I/O and transfer rate statistics

 

5. sar command to display statistics for the specified processor

-P option helps to report per-processor statistics for the specified processor or processors. The processor 0 is the first processor.

$ sar -P 0

Sample Output:

sar command to report per-processor statistics

The ALL keyword reports statistics for each individual processor, and globally for all processors.

$ sar -P ALL

 

6. sar command to view swap space utilization statistics

You can use -S option to display swap space utilization statistics.

$ sar -S

Sample Output:

sar command to report swap space utilization statistics

 

7. sar command to display M reports for every N seconds

The following command displays M number of reports for every N seconds.

$ sat option N M

Sample Output:

For example, to display 7 swap space utilization reports for every 2 seconds, you can use the following command.

sar command to display swap space utilization statistics

 

8. sar command to display memory swapping statistics

-W option in sar command is used to report swapping statistics.

$ sar -W

Sample Output:

sar command to report swapping statistics

pswpin/s - Total number of swap pages the system brought in per second.

pswpout/s - Total number of swap pages the system brought out per second.

 

9. sar command to display filesystems statistics

-F option helps to display the statistics of filesystems mounted on the device.

$ sar -F

Sample Output:

sar command to display filesystems statistics

 

10. sar command to display network statistics

-n option is used to report network statistics.

$ sar -n keyword

Sample Output:

With the DEV keyword, statistics from the network devices are reported.

sar command to report network statistics

The possible keywords are:

DEV, EDEV, NFS, NFSD, SOCK, IP, EIP, ICMP, EICMP, TCP, ETCP, UDP, SOCK6, IP6, EIP6, ICMP6, EICMP6 and UDP6.

 

11. Display all network statistics using sar command

The ALL keyword with -n is equivalent to specifying all the keywords above and therefore all the network activities are reported.

$ sar -n ALL

Sample Output:

~]# sar -n ALL 
12:10:01 AM      eth6      0.02      0.00      0.00      0.00      0.00      0.00      0.00
12:10:01 AM      eth3     11.20     10.28      2.71      2.42      0.00      0.00      0.00
12:10:01 AM      eth7      1.31      0.00      0.05      0.00      0.00      0.00      0.00
12:10:01 AM      eth5      0.98      0.00      0.05      0.00      0.00      0.00      0.00
12:10:01 AM      eth0      1.33      1.44      0.36      0.14      0.00      0.00      0.00
12:10:01 AM      eth1      0.00      0.00      0.00      0.00      0.00      0.00      0.00
12:10:01 AM      eth2   1462.06   1318.52   2242.77   3145.06      0.00      0.00      0.00
12:10:01 AM      eth4      0.98      0.00      0.05      0.00      0.00      0.00      0.00
12:10:01 AM      eth8      0.00      0.00      0.00      0.00      0.00      0.00      0.00
12:20:01 AM      eth6      0.00      0.00      0.00      0.00      0.00      0.00      0.00
...

 

12. sar command to display block devices statistics

-d option is used to report activity for each block device. When data is displayed, the device specification dev m-n is generally used ( DEV column). m is the major number of the device and n is the minor number of the device.

$ sar -d

Sample Output:

sar command to display block devices statistics

 

13. Display queue length and load averages using sar command

You can use -q option to display the report about queue length and load averages.

$ sar -q

Sample Output:

sar command to report queue length and load averages

 

 14. sar command to display paging statistics

-B option is used to report paging statistics.

$ sar -B

Sample Output:

sar command to display paging statistics

 

15. Extract reports from file with sar command

-f option extracts the records from the filename. We have already explained this part at the beginning of the tutorial. The report file generated by sar using cron job can be read using sar -f command:

$ sar -f /dir/file

Sample Output:

sar command to extract report from filename

 

16. sar command to report task creation and system switching activity

You can view the task creation and system switching activity using -w option with sar command.

$ sar -w [interval] [count]

Sample Output:

sar command to report task creation

proc/s - Total number of tasks created per second.

cswch/s - Total number of context switches per second.

 

17. Display report about kernel tables using sar command

-v option displays the status of the inode, file and other kernel tables.

$ sar -v [interval] [count]

Sample Output:

sar command to display kernel tables report

Here,

  • dentunusd - Number of unused cache entries in the directory cache.
  • file-nr - Number of file handles used by the system.
  • inode-nr - Number of inode handlers used by the system.
  • pty-nr - Number of pseudo-terminals used by the system.

 

18. Report statistics for a given interrupt with sar command

-I option is used to display statistics for given interrupt number. int is the interrupt number.

$ sar -I int

Sample Output:

The below command displays 6 reports of 5 interrupt for every 2 seconds.

sar command to Report statistics for a given interrupt

The other keywords available with -I option are:

  • SUM - It displays the total number of interrupts received per second.
  • ALL - It reports statistics from the first 16 interrupts.
  • XALL - It displays statistics from all interrupts, including potential APIC interrupt sources.

 

19. sar command to display all statistics

-A option is equivalent to specifying -bBdqrRSuvwWy -I SUM -I XALL -n ALL -u ALL -P ALL.

$ sar -A

Sample Output:

~]# sar -A
Linux 4.18.0-193.19.1.2009211817.el7_8.emrs.altmvl.x86_64 (fi-758-ncs20fp2-5-cluster-01-cs-01) 	11/07/2021 	_x86_64_	(16 CPU)

12:00:01 AM     CPU      %usr     %nice      %sys   %iowait    %steal      %irq     %soft    %guest    %gnice     %idle
12:10:01 AM     all      4.44      0.00      1.84      0.88      0.00      0.33      0.34      0.00      0.00     92.17
12:10:01 AM       0      4.63      0.00      1.83      0.82      0.00      0.27      0.39      0.00      0.00     92.04
12:10:01 AM       1      4.21      0.00      1.80      0.74      0.00      0.38      0.26      0.00      0.00     92.60
12:10:01 AM       2      4.70      0.00      1.93      0.63      0.00      0.33      0.26      0.00      0.00     92.15
12:10:01 AM       3      4.71      0.00      1.92      0.76      0.00      0.29      0.21      0.00      0.00     92.11
12:10:01 AM       4      4.41      0.00      1.92      0.89      0.00      0.43      1.88      0.00      0.00     90.46
12:10:01 AM       5      4.38      0.00      1.79      0.84      0.00      0.28      0.22      0.00      0.00     92.49
....

 

20. sar command to display power management statistics

-m option allows you to display power management reports using the following syntax.

$ sar -m keyword

Available keywords are:

  • CPU - CPU instantaneous clock frequency
  • FAN - Fans speed
  • FREQ - CPU average clock frequency
  • IN - Voltage inputs
  • TEMP - Devices temperature
  • USB - USB devices plugged into the system

Conclusion

In this way, we can use sar command to view reports about CPU utilization, memory utilization, I/O usage, swapping statistics, filesystems statistics, network statistics, etc. We hope you have learned the usage of sar command from this article. If you still have any confusion, please feel free to ask us in the comment section.

 

What's Next

15+ iostat command examples in Linux [Cheat Sheet]

 

Further Reading

man page for sar command

 

Rohan Timalsina

Rohan Timalsina

He is proficient in a wide range of skills, including Page Builder Plugins such as Elementor, Beaver Builder, Visual Composer, and Divi Builder. His expertise extends to Front End Development with HTML5/CSS3, JavaScript, Bootstrap, and React.js. You can connect with him on his LinkedIn profile.

Can't find what you're searching for? Let us assist you.

Enter your query below, and we'll provide instant results tailored to your needs.

If my articles on GoLinuxCloud has helped you, kindly consider buying me a coffee as a token of appreciation.

Buy GoLinuxCloud a Coffee

For any other feedbacks or questions you can send mail to admin@golinuxcloud.com

Thank You for your support!!

Leave a Comment