cheatsheet

sar Command in Linux: Syntax, Options & Performance Reports (Ubuntu)

sar (System Activity Reporter) prints CPU, memory, disk, network, and load averages from live counters or files collected by sysstat under /var/log/sysstat. Install the sysstat package and enable data collection for historical reports.

Published

Updated

Read time 11 min read

Reviewed byDeepak Prasad

sar Command in Linux: Syntax, Options & Performance Reports (Ubuntu)
About sar (System Activity Reporter) prints CPU, memory, disk, network, and load averages from live counters or files collected by sysstat under /var/log/sysstat. Install the sysstat package and enable data collection for historical reports.
Tested on Ubuntu 25.04 (Plucky Puffin); sysstat 12.7.5; kernel 7.0.0-27-generic
Package sysstat (apt/deb) · sysstat (dnf/rpm)
Man page sar(1)
Privilege user (reading some reports may need root)
Distros

All distros shipping sysstat (Ubuntu, Debian, RHEL, Fedora, SUSE, and others).

Real-time process view: top. Block-device snapshot: iostat.

sar — quick reference

CPU and processors

When to use Command
CPU utilization since boot (default report) sar
CPU utilization report sar -u
CPU report with all fields (irq, soft, guest, …) sar -u ALL
Per-processor statistics for CPU 0 sar -P 0
Per-processor stats for every CPU plus global average sar -P ALL
All activity reports in one run (large output) sar -A

Memory, swap, and paging

When to use Command
Memory utilization sar -r
Memory report with all fields sar -r ALL
Swap space utilization sar -S
Paging statistics sar -B
Memory swapping (pages in/out per second) sar -W
Hugepages utilization sar -H

Disk and I/O

When to use Command
I/O and transfer rate statistics sar -b
Block device activity sar -d
Omit idle block devices from -d output sar -z -d
Filesystem space statistics sar -F
Filesystem stats for one mount point sar -F /

Network

When to use Command
Network interface throughput (packets and kB/s) sar -n DEV
Network interface error counters sar -n EDEV
NFS client statistics sar -n NFS
NFS server statistics sar -n NFSD
IPv4 socket statistics sar -n SOCK
IPv4 IP traffic sar -n IP
IPv4 IP errors sar -n EIP
IPv4 ICMP traffic sar -n ICMP
IPv4 ICMP errors sar -n EICMP
IPv4 TCP traffic sar -n TCP
IPv4 TCP errors sar -n ETCP
IPv4 UDP traffic sar -n UDP
IPv6 socket statistics sar -n SOCK6
IPv6 IP traffic sar -n IP6
IPv6 IP errors sar -n EIP6
IPv6 ICMP traffic sar -n ICMP6
IPv6 ICMP errors sar -n EICMP6
IPv6 UDP traffic sar -n UDP6
Fibre channel HBA statistics sar -n FC
Software network processing sar -n SOFT
All network keyword reports sar -n ALL

Load, tasks, and kernel tables

When to use Command
Run-queue length and load averages sar -q
Load averages only (queue keyword) sar -q LOAD
Pressure-stall CPU statistics sar -q CPU
Pressure-stall I/O statistics sar -q IO
Pressure-stall memory statistics sar -q MEM
All load and PSI keywords sar -q ALL
Task creation and context switches sar -w
Inode, file, and kernel table usage sar -v
Interrupt totals per second sar -I SUM
First 16 interrupt lines sar -I ALL
TTY device activity sar -y

Power management (-m)

When to use Command
Battery capacity sar -m BAT
CPU instantaneous clock frequency sar -m CPU
Fan speed sar -m FAN
CPU average clock frequency sar -m FREQ
Voltage inputs sar -m IN
Device temperature sensors sar -m TEMP
USB devices plugged in sar -m USB
All power-management keywords sar -m ALL

Live interval and historical files

When to use Command
Sample every N seconds until Ctrl+C sar -u 2
Take M samples every N seconds then exit sar -u 2 5
Read a saved data file (default dir /var/log/sysstat) sar -f /var/log/sysstat/sa01
Yesterday's data file (relative day offset) sar -1
Two days ago sar -2
Save live samples to a binary file sar -o /tmp/sar.out -u 2 3
Show timestamps when reading archive files sar -t -f /var/log/sysstat/sa01
Show comments embedded in archive files sar -C -f /var/log/sysstat/sa01
Use saYYYYMMDD naming when writing with -o sar -D -o /var/log/sysstat/sa20260701 -u 2 3
Start time filter when reading archives (HH:MM:SS) sar -s 09:00:00 -e 12:00:00 -f /var/log/sysstat/sa01

Output filters and format

When to use Command
Limit block devices in -d output sar --dev=sda -d
Limit filesystems in -F output sar --fs=/ -F
Limit network interfaces in -n DEV sar --iface=lo -n DEV
Limit interrupt numbers in -I output sar --int=1 -I SUM
Human-readable percentages (-h alias) sar -h -u 1 1
Pretty-printed output sar --pretty -u 1 1
Human-readable units sar --human -u 1 1
Decimal places for percentages (0, 1, or 2) sar --dec=2 -u 1 1
Show min/max columns (extended report) sar -x -u 1 1
Print sadc command line that collected data sar --sadc -f /var/log/sysstat/sa01

Help and version

When to use Command
Brief usage (main report flags) sar --help
Package version sar -V

sar — command syntax

Synopsis from sar --help on Ubuntu 25.04 (sysstat 12.7.5):

text 
Usage: sar [ options ] [ <interval> [ <count> ] ]

With no options, sar prints CPU utilization averaged since boot. With interval and optional count, it samples live counters. With -f or a negative day offset (-1), it reads binary archives written by sadc — usually under /var/log/sysstat when the sysstat service is enabled.

sar — command examples

Essential Live CPU samples every 2 seconds

Use a short interval when you need to see whether CPU spikes are sustained or brief — keep intervals at 1–5 seconds on busy hosts.

Run the command:

bash 
sar -u 2 3

Sample output:

text 
Linux 7.0.0-27-generic (server1) 	07/01/2026 	_x86_64_	(2 CPU)

02:40:00 PM     CPU     %user     %nice   %system   %iowait    %steal     %idle
02:40:01 PM     all      1.25      0.00      5.62      0.00      0.00     93.12
02:40:02 PM     all     12.12      0.00     50.91      0.00      0.00     36.97
Average:        all      6.77      0.00     28.62      0.00      0.00     64.62

High %system with low %idle often points to kernel or syscall-heavy work; pair with sar -w or top to see which processes drive it.

Essential Memory and disk I/O in one troubleshooting pass

When a host feels slow, check whether the bottleneck is RAM pressure or disk wait before tuning applications.

Run memory utilization:

bash 
sar -r 1 1

Sample output:

text 
02:40:02 PM kbmemfree   kbavail kbmemused  %memused kbbuffers  kbcached  kbcommit   %commit  kbactive   kbinact   kbdirty
02:40:03 PM    586764   3218804   1753964     32.36     93140   2674412   7014904     88.17   1589676   2726140       320
Average:       586764   3218804   1753964     32.36     93140   2674412   7014904     88.17   1589676   2726140       320

Then check I/O rates:

bash 
sar -b 1 1

Sample output:

text 
02:40:04 PM       tps      rtps      wtps      dtps   bread/s   bwrtn/s   bdscd/s
02:40:05 PM      0.00      0.00      0.00      0.00      0.00      0.00      0.00
Average:         0.00      0.00      0.00      0.00      0.00      0.00      0.00

%commit above 100% means swap or OOM risk is possible; high bread/s or bwrtn/s with elevated %iowait in sar -u suggests a storage bottleneck — see iostat for per-device detail.

Common Block devices and network interfaces

Disk and network reports help you tell apart storage latency and NIC saturation during an incident.

Run block device stats (trim idle loops with -z on noisy VMs):

bash 
sar -d 1 1 | tail -5

Run per-interface throughput:

bash 
sar -n DEV 1 1

Sample output:

text 
02:40:07 PM        IFACE   rxpck/s   txpck/s    rxkB/s    txkB/s   rxcmp/s   txcmp/s  rxmcst/s   %ifutil
02:40:07 PM           lo      9.02      9.02      0.67      0.67      0.00      0.00      0.00      0.00
02:40:07 PM       enp0s3      6.56      6.56      0.56      0.60      0.00      0.00      0.00      0.00

Rising %ifutil on a physical NIC with flat application throughput can mean a link or driver limit — use sar -n EDEV for error counters.

Common Read historical data from /var/log/sysstat

sar without an interval reads averages since boot. For trends across the day, read the binary files sa1 … sa31 (or saYYYYMMDD) that sadc writes when sysstat collection is enabled.

List available archives:

bash 
ls -l /var/log/sysstat/sa*

Read today's file (day 01 in July):

bash 
sar -f /var/log/sysstat/sa01 | head -10

Sample output:

text 
Linux 7.0.0-27-generic (server1) 	07/01/2026 	_x86_64_	(2 CPU)

08:54:32 AM  LINUX RESTART	(2 CPU)

09:00:00 AM     CPU     %user     %nice   %system   %iowait    %steal     %idle
09:10:01 AM     all      3.57      0.02      7.91      0.31      0.00     88.19
09:20:00 AM     all      7.82      0.05     20.07      5.02      0.00     67.05

If /var/log/sysstat is empty, enable collection: set ENABLED="true" in /etc/default/sysstat and run sudo systemctl restart sysstat. See the systemctl command for enable --now and collector unit status.

Common Per-CPU breakdown with -P ALL

A single hot CPU on a multi-core host shows up in the global average as a modest spike — per-CPU view makes uneven load obvious.

Run the command:

bash 
sar -P ALL 1 1

Sample output:

text 
Average:        CPU     %user     %nice   %system   %iowait    %steal     %idle
Average:        all     35.71      0.00     64.29      0.00      0.00      0.00
Average:          0     35.71      0.00     64.29      0.00      0.00      0.00
Average:          1     35.71      0.00     64.29      0.00      0.00      0.00

Compare with sar -u ALL when you need irq/softirq columns on each CPU.

Common Run queue and load averages

Load averages answer “how many tasks are waiting for CPU time?” — useful when %idle looks fine but latency is high.

Run the command:

bash 
sar -q 1 1

Sample output:

text 
02:40:07 PM   runq-sz  plist-sz   ldavg-1   ldavg-5  ldavg-15   blocked
02:40:08 PM         5       638      2.01      1.04      1.22         0
Average:            5       638      2.01      1.04      1.22         0

runq-sz above CPU count for long stretches with high ldavg-1 usually means CPU saturation; high blocked points to I/O wait — cross-check sar -b and sar -d.

Common Human-readable percentages with -h

Scripts and dashboards sometimes need percent signs on CPU columns without post-processing.

Run the command:

bash 
sar -h -u 1 1

Sample output:

text 
02:40:56 PM     CPU     %user     %nice   %system   %iowait    %steal     %idle
02:40:57 PM     all      9.1%      0.0%     16.8%      0.7%      0.0%     73.4%
Average:        all      9.1%      0.0%     16.8%      0.7%      0.0%     73.4%

-h is equivalent to --pretty --human on sysstat 12.7.5.

Advanced No archive files — enable sysstat collection

Fresh installs often ship with sar installed but no historical files until sysstat collection is turned on.

Check whether the service is active:

bash 
systemctl is-active sysstat
cat /etc/default/sysstat | grep ENABLED

Sample output when collection is on:

text 
active
ENABLED="true"

If ls /var/log/sysstat is empty after enabling, wait for the cron job in /etc/cron.d/sysstat (default every 10 minutes) or run sudo sa1 1 1 once to seed a file, then retry sar -f /var/log/sysstat/sa$(date +%d).

sar — when to use / when not

Use sar when Use something else when
  • You need CPU, memory, disk, or network trends over hours or days from /var/log/sysstat
  • You want repeatable interval sampling (`sar -u 2 10`) for before/after comparisons
  • You are already using the sysstat suite and want one tool for many resource classes
  • You need per-CPU or per-interface breakdowns from archived data
  • You need a live, sortable process list → top or ps
  • You want per-process disk I/O right now → iotop
  • You need detailed per-disk throughput and util% in one snapshot → iostat
  • You want instantaneous memory and swap counters without archives → vmstat
  • /var/log/sysstat is empty and you cannot enable sysstat collection → live sar INTERVAL only, or use real-time tools above

sar vs iostat

Both come from sysstat and read kernel counters, but they emphasize different views.

sar iostat
Primary focus Many resource classes; historical files Disk I/O and CPU line per device
Historical data Yes (-f, /var/log/sysstat) Limited (mainly live)
Per-process detail No No
Best for Daily trends, mixed CPU/mem/disk/net Storage bottleneck analysis

See the iostat command for device-level %util and await columns.

Tools in the same performance-monitoring workflow — live view, archives, and storage detail.

Command One line
sar System activity reporter (this page)

Browse the full index in our Linux commands reference.

sar — interview corner

What does the sar command do in Linux?

sar (System Activity Reporter) is part of the sysstat package. It reads kernel activity counters and prints reports for CPU, memory, disk, network, load, and more.

Two modes matter in practice:

  1. Live — sar -u 2 5 samples every 2 seconds, five times.
  2. Historical — sar -f /var/log/sysstat/sa01 replays data collected by sadc when sysstat collection is enabled.

A strong answer is:

"sar reports system activity from sysstat — live with an interval/count, or from binary archives under /var/log/sysstat. I use it for CPU, memory, disk, and network trends over time."

When would you use sar instead of top?

top shows which processes use CPU and memory right now. sar summarizes resource classes over time and can read archived samples — better for answering "was disk I/O high last Tuesday at 14:00?"

Use top for interactive triage; use sar for capacity planning, post-incident timelines, and proving a pattern across reboots (when archives exist).

A strong answer is:

"top for live per-process view; sar for interval sampling and historical sysstat files when I need trends across hours or days, not just the current process list."

Where does sar store historical data on Ubuntu?

On Debian and Ubuntu, sadc usually writes to /var/log/sysstat. Files are named saDD or saYYYYMMDD. The sysstat service must be enabled (ENABLED="true" in /etc/default/sysstat) and cron jobs in /etc/cron.d/sysstat must run.

Read them with sar -f /var/log/sysstat/sa01 or sar -1 for yesterday.

A strong answer is:

"Under /var/log/sysstat as saDD or saYYYYMMDD binaries, populated by sadc when sysstat is enabled — I read them with sar -f or sar -1 for yesterday."

How do you investigate high I/O wait with sar?

Start with sar -u — high %iowait means CPUs idle while waiting on storage. Then run sar -b (aggregate transfer rates) and sar -d (per block device). Pair with iostat for %util and await per disk.

A strong answer is:

"I check %iowait in sar -u, then sar -b and sar -d for transfer and per-device activity, and iostat when I need util% and service time per disk."

How do you install sar on Ubuntu?

Install the sysstat package — sar, iostat, mpstat, and sadc ship together:

bash 
sudo apt install sysstat

Enable collection in /etc/default/sysstat, restart the service, and confirm files appear under /var/log/sysstat.

A strong answer is:

"apt install sysstat — sar is not a separate package. I enable ENABLED=true, restart sysstat, and verify sa* files under /var/log/sysstat."

Troubleshooting

Symptom Likely cause Fix
Cannot open /var/log/sysstat/saXX: No such file Collection disabled or file not created yet Set ENABLED="true" in /etc/default/sysstat; sudo systemctl restart sysstat; wait for cron or run sudo sa1 1 1
sar: command not found sysstat not installed sudo apt install sysstat
Empty or single-line output for -m TEMP / -m FAN No sensors exposed on VM or hardware Expected on many cloud VMs; omit those reports or use host hypervisor metrics
Invalid option for a flag Older sysstat build Match flags to sar --help on your host (this page matches sysstat 12.7.5)
Live sar 1 adds noticeable load Interval too aggressive on tiny instances Use 2–10 second intervals or read archives instead
Rohan Timalsina

is a technical writer and Linux enthusiast who writes practical guides on Linux commands and system administration. He focuses on simplifying complex topics through clear explanations.

Related Articles

linux

How to Check CPU Usage in Linux (Top, htop, vmstat & More)

Learn how to check CPU usage in Linux using top, htop, vmstat, mpstat, sar, and ps commands. Monitor CPU …

10 min readprogramming

Golang CPU affinity on Linux: sched_setaffinity, taskset, GOMAXPROCS

Golang CPU affinity on Linux: cpu masking with golang.org/x/sys/unix SchedSetaffinity, taskset from Go, …

4 min readcheatsheet

lscpu Command in Linux: CPU Architecture, Cores & JSON Output

lscpu prints CPU topology from sysfs and /proc/cpuinfo — sockets, cores, threads, NUMA nodes, caches, and …

7 min read