SAR(1) Linux User's Manual SAR(1)NAMEsar - Collect, report, or save system activity information.
SYNOPSISsar [ -A ] [ -b ] [ -B ] [ -C ] [ -d ] [ -i interval ] [ -p ] [ -q ] [
-r ] [ -R ] [ -S ] [ -t ] [ -u [ ALL ] ] [ -v ] [ -V ] [ -w ] [ -W ] [
-y ] [ -n { DEV | EDEV | NFS | NFSD | SOCK | ALL } ] [ -I { irq | SUM |
ALL | XALL } ] [ -P { cpu | ALL } ] [ -o [ filename ] | -f [ filename ]
] [ -s [ hh:mm:ss ] ] [ -e [ hh:mm:ss ] ] [ interval [ count ] ]
DESCRIPTION
The sar command writes to standard output the contents of selected
cumulative activity counters in the operating system. The accounting
system, based on the values in the count and interval parameters,
writes information the specified number of times spaced at the speci‐
fied intervals in seconds. If the interval parameter is set to zero,
the sar command displays the average statistics for the time since the
system was started. If the interval parameter is specified without the
count parameter, then reports are generated continuously. The col‐
lected data can also be saved in the file specified by the -o filename
flag, in addition to being displayed onto the screen. If filename is
omitted, sar uses the standard system activity daily data file, the
/var/log/sa/sadd file, where the dd parameter indicates the current
day. By default all the data available from the kernel are saved in
the data file.
The sar command extracts and writes to standard output records previ‐
ously saved in a file. This file can be either the one specified by the
-f flag or, by default, the standard system activity daily data file.
Without the -P flag, the sar command reports system-wide (global among
all processors) statistics, which are calculated as averages for values
expressed as percentages, and as sums otherwise. If the -P flag is
given, the sar command reports activity which relates to the specified
processor or processors. If -P ALL is given, the sar command reports
statistics for each individual processor and global statistics among
all processors.
You can select information about specific system activities using
flags. Not specifying any flags selects only CPU activity. Specifying
the -A flag is equivalent to specifying -bBdqrRSvwWy -I SUM -I XALL -n
ALL -u ALL -P ALL.
The default version of the sar command (CPU utilization report) might
be one of the first facilities the user runs to begin system activity
investigation, because it monitors major system resources. If CPU uti‐
lization is near 100 percent (user + nice + system), the workload sam‐
pled is CPU-bound.
If multiple samples and multiple reports are desired, it is convenient
to specify an output file for the sar command. Run the sar command as
a background process. The syntax for this is:
sar-o datafile interval count >/dev/null 2>&1 &
All data is captured in binary form and saved to a file (datafile).
The data can then be selectively displayed with the sar command using
the -f option. Set the interval and count parameters to select count
records at interval second intervals. If the count parameter is not
set, all the records saved in the file will be selected. Collection of
data in this manner is useful to characterize system usage over a
period of time and determine peak usage hours.
Note: The sar command only reports on local activities.
OPTIONS-A This is equivalent to specifying -bBdqrRSuvwWy -I SUM -I XALL -n
ALL -u ALL -P ALL.
-b Report I/O and transfer rate statistics. The following values
are displayed:
tps
Total number of transfers per second that were issued to
physical devices. A transfer is an I/O request to a
physical device. Multiple logical requests can be com‐
bined into a single I/O request to the device. A trans‐
fer is of indeterminate size.
rtps
Total number of read requests per second issued to physi‐
cal devices.
wtps
Total number of write requests per second issued to phys‐
ical devices.
bread/s
Total amount of data read from the devices in blocks per
second. Blocks are equivalent to sectors with 2.4 ker‐
nels and newer and therefore have a size of 512 bytes.
With older kernels, a block is of indeterminate size.
bwrtn/s
Total amount of data written to devices in blocks per
second.
-B Report paging statistics. Some of the metrics below are avail‐
able only with post 2.5 kernels. The following values are dis‐
played:
pgpgin/s
Total number of kilobytes the system paged in from disk
per second. Note: With old kernels (2.2.x) this value is
a number of blocks per second (and not kilobytes).
pgpgout/s
Total number of kilobytes the system paged out to disk
per second. Note: With old kernels (2.2.x) this value is
a number of blocks per second (and not kilobytes).
fault/s
Number of page faults (major + minor) made by the system
per second. This is not a count of page faults that gen‐
erate I/O, because some page faults can be resolved with‐
out I/O.
majflt/s
Number of major faults the system has made per second,
those which have required loading a memory page from
disk.
pgfree/s
Number of pages placed on the free list by the system per
second.
pgscank/s
Number of pages scanned by the kswapd daemon per second.
pgscand/s
Number of pages scanned directly per second.
pgsteal/s
Number of pages the system has reclaimed from cache
(pagecache and swapcache) per second to satisfy its mem‐
ory demands.
%vmeff
Calculated as pgsteal / pgscan, this is a metric of the
efficiency of page reclaim. If it is near 100% then
almost every page coming off the tail of the inactive
list is being reaped. If it gets too low (e.g. less than
30%) then the virtual memory is having some difficulty.
This field is displayed as zero if no pages have been
scanned during the interval of time.
-C When reading data from a file, tell sar to display comments that
have been inserted by sadc.
-d Report activity for each block device (kernels 2.4 and newer
only). When data is displayed, the device specification dev m-n
is generally used ( DEV column). m is the major number of the
device. With recent kernels (post 2.5), n is the minor number
of the device, but is only a sequence number with pre 2.5 ker‐
nels. Device names may also be pretty-printed if option -p is
used (see below). Values for fields avgqu-sz, await, svctm and
%util may be unavailable and displayed as 0.00 with some 2.4
kernels.
tps
Indicate the number of transfers per second that were
issued to the device. Multiple logical requests can be
combined into a single I/O request to the device. A
transfer is of indeterminate size.
rd_sec/s
Number of sectors read from the device. The size of a
sector is 512 bytes.
wr_sec/s
Number of sectors written to the device. The size of a
sector is 512 bytes.
avgrq-sz
The average size (in sectors) of the requests that were
issued to the device.
avgqu-sz
The average queue length of the requests that were issued
to the device.
await
The average time (in milliseconds) for I/O requests
issued to the device to be served. This includes the time
spent by the requests in queue and the time spent servic‐
ing them.
svctm
The average service time (in milliseconds) for I/O
requests that were issued to the device.
%util
Percentage of CPU time during which I/O requests were
issued to the device (bandwidth utilization for the
device). Device saturation occurs when this value is
close to 100%.
-e [ hh:mm:ss ]
Set the ending time of the report. The default ending time is
18:00:00. Hours must be given in 24-hour format. This option
can be used when data are read from or written to a file
(options -f or -o ).
-f [ filename ]
Extract records from filename (created by the -o filename flag).
The default value of the filename parameter is the current daily
data file, the /var/log/sa/sadd file. The -f option is exclusive
of the -o option.
-i interval
Select data records at seconds as close as possible to the num‐
ber specified by the interval parameter.
-I { irq | SUM | ALL | XALL }
Report statistics for a given interrupt. irq is the interrupt
number. Specifying multiple -I irq parameters on the command
line will look at multiple independent interrupts. The SUM key‐
word indicates that the total number of interrupts received per
second is to be displayed. The ALL keyword indicates that sta‐
tistics from the first 16 interrupts are to be reported, whereas
the XALL keyword indicates that statistics from all interrupts,
including potential APIC interrupt sources, are to be reported.
-n { DEV | EDEV | NFS | NFSD | SOCK | ALL }
Report network statistics.
With the DEV keyword, statistics from the network devices are
reported. The following values are displayed:
IFACE
Name of the network interface for which statistics are
reported.
rxpck/s
Total number of packets received per second.
txpck/s
Total number of packets transmitted per second.
rxkB/s
Total number of kilobytes received per second.
txkB/s
Total number of kilobytes transmitted per second.
rxcmp/s
Number of compressed packets received per second (for
cslip etc.).
txcmp/s
Number of compressed packets transmitted per second.
rxmcst/s
Number of multicast packets received per second.
With the EDEV keyword, statistics on failures (errors) from the
network devices are reported. The following values are dis‐
played:
IFACE
Name of the network interface for which statistics are
reported.
rxerr/s
Total number of bad packets received per second.
txerr/s
Total number of errors that happened per second while
transmitting packets.
coll/s
Number of collisions that happened per second while
transmitting packets.
rxdrop/s
Number of received packets dropped per second because of
a lack of space in linux buffers.
txdrop/s
Number of transmitted packets dropped per second because
of a lack of space in linux buffers.
txcarr/s
Number of carrier-errors that happened per second while
transmitting packets.
rxfram/s
Number of frame alignment errors that happened per second
on received packets.
rxfifo/s
Number of FIFO overrun errors that happened per second on
received packets.
txfifo/s
Number of FIFO overrun errors that happened per second on
transmitted packets.
With the NFS keyword, statistics about NFS client activity are
reported. The following values are displayed:
call/s
Number of RPC requests made per second.
retrans/s
Number of RPC requests per second, those which needed to
be retransmitted (for example because of a server time‐
out).
read/s
Number of 'read' RPC calls made per second.
write/s
Number of 'write' RPC calls made per second.
access/s
Number of 'access' RPC calls made per second.
getatt/s
Number of 'getattr' RPC calls made per second.
With the NFSD keyword, statistics about NFS server activity are
reported. The following values are displayed:
scall/s
Number of RPC requests received per second.
badcall/s
Number of bad RPC requests received per second, those
whose processing generated an error.
packet/s
Number of network packets received per second.
udp/s
Number of UDP packets received per second.
tcp/s
Number of TCP packets received per second.
hit/s
Number of reply cache hits per second.
miss/s
Number of reply cache misses per second.
sread/s
Number of 'read' RPC calls received per second.
swrite/s
Number of 'write' RPC calls received per second.
saccess/s
Number of 'access' RPC calls received per second.
sgetatt/s
Number of 'getattr' RPC calls received per second.
With the SOCK keyword, statistics on sockets in use are
reported. The following values are displayed:
totsck
Total number of sockets used by the system.
tcpsck
Number of TCP sockets currently in use.
udpsck
Number of UDP sockets currently in use.
rawsck
Number of RAW sockets currently in use.
ip-frag
Number of IP fragments currently in use.
tcp-tw
Number of TCP sockets in TIME_WAIT state.
The ALL keyword is equivalent to specifying all the keywords
above and therefore all the network activities are reported.
-o [ filename ]
Save the readings in the file in binary form. Each reading is in
a separate record. The default value of the filename parameter
is the current daily data file, the /var/log/sa/sadd file. The
-o option is exclusive of the -f option.
-P { cpu | ALL }
Report per-processor statistics for the specified processor or
processors. Specifying the ALL keyword reports statistics for
each individual processor, and globally for all processors.
Note that processor 0 is the first processor.
-p Pretty-print device names. Use this option in conjunction with
option -d. By default names are printed as dev m-n where m and
n are the major and minor numbers for the device. Use of this
option displays the names of the devices as they (should) appear
in /dev. Name mappings are controlled by /etc/sysstat/sys‐
stat.ioconf.
-q Report queue length and load averages. The following values are
displayed:
runq-sz
Run queue length (number of tasks waiting for run time).
plist-sz
Number of tasks in the task list.
ldavg-1
System load average for the last minute. The load aver‐
age is calculated as the average number of runnable or
running tasks (R state), and the number of tasks in unin‐
terruptible sleep (D state) over the specified interval.
ldavg-5
System load average for the past 5 minutes.
ldavg-15
System load average for the past 15 minutes.
-r Report memory utilization statistics. The following values are
displayed:
kbmemfree
Amount of free memory available in kilobytes.
kbmemused
Amount of used memory in kilobytes. This does not take
into account memory used by the kernel itself.
%memused
Percentage of used memory.
kbbuffers
Amount of memory used as buffers by the kernel in kilo‐
bytes.
kbcached
Amount of memory used to cache data by the kernel in
kilobytes.
kbcommit
Amount of memory in kilobytes needed for current work‐
load. This is an estimate of how much RAM/swap is needed
to guarantee that there never is out of memory.
%commit
Percentage of memory needed for current workload in rela‐
tion to the total amount of memory (RAM+swap). This num‐
ber may be greater than 100% because the kernel usually
overcommits memory.
-R Report memory statistics. The following values are displayed:
frmpg/s
Number of memory pages freed by the system per second. A
negative value represents a number of pages allocated by
the system. Note that a page has a size of 4 kB or 8 kB
according to the machine architecture.
bufpg/s
Number of additional memory pages used as buffers by the
system per second. A negative value means fewer pages
used as buffers by the system.
campg/s
Number of additional memory pages cached by the system
per second. A negative value means fewer pages in the
cache.
-s [ hh:mm:ss ]
Set the starting time of the data, causing the sar command to
extract records time-tagged at, or following, the time speci‐
fied. The default starting time is 08:00. Hours must be given
in 24-hour format. This option can be used only when data are
read from a file (option -f ).
-S Report swap space utilization statistics. The following values
are displayed:
kbswpfree
Amount of free swap space in kilobytes.
kbswpused
Amount of used swap space in kilobytes.
%swpused
Percentage of used swap space.
kbswpcad
Amount of cached swap memory in kilobytes. This is mem‐
ory that once was swapped out, is swapped back in but
still also is in the swap area (if memory is needed it
doesn't need to be swapped out again because it is
already in the swap area. This saves I/O).
%swpcad
Percentage of cached swap memory in relation to the
amount of used swap space.
-t When reading data from a daily data file, indicate that sar
should display the timestamps in the original locale time of the
data file creator. Without this option, the sar command displays
the timestamps in the user's locale time.
-u [ ALL ]
Report CPU utilization. The ALL keyword indicates that all the
CPU fields should be displayed. The report may show the follow‐
ing fields:
%user
Percentage of CPU utilization that occurred while execut‐
ing at the user level (application). Note that this field
includes time spent running virtual processors.
%usr
Percentage of CPU utilization that occurred while execut‐
ing at the user level (application). Note that this field
does NOT include time spent running virtual processors.
%nice
Percentage of CPU utilization that occurred while execut‐
ing at the user level with nice priority.
%system
Percentage of CPU utilization that occurred while execut‐
ing at the system level (kernel). Note that this field
includes time spent servicing interrupts and softirqs.
%sys
Percentage of CPU utilization that occurred while execut‐
ing at the system level (kernel). Note that this field
does NOT include time spent servicing interrupts or
softirqs.
%iowait
Percentage of time that the CPU or CPUs were idle during
which the system had an outstanding disk I/O request.
%steal
Percentage of time spent in involuntary wait by the vir‐
tual CPU or CPUs while the hypervisor was servicing
another virtual processor.
%irq
Percentage of time spent by the CPU or CPUs to service
interrupts.
%soft
Percentage of time spent by the CPU or CPUs to service
softirqs (software interrupts).
%guest
Percentage of time spent by the CPU or CPUs to run a vir‐
tual processor.
%idle
Percentage of time that the CPU or CPUs were idle and the
system did not have an outstanding disk I/O request.
Note: On SMP machines a processor that does not have any activ‐
ity at all (0.00 for every field) is a disabled (offline) pro‐
cessor.
-v Report status of inode, file and other kernel tables. The fol‐
lowing values are displayed:
dentunusd
Number of unused cache entries in the directory cache.
file-nr
Number of file handles used by the system.
inode-nr
Number of inode handlers used by the system.
pty-nr
Number of pseudo-terminals used by the system.
-V Print version number then exit.
-w Report task creation and system switching activity.
proc/s
Total number of tasks created per second.
cswch/s
Total number of context switches per second.
-W Report swapping statistics. The following values are displayed:
pswpin/s
Total number of swap pages the system brought in per sec‐
ond.
pswpout/s
Total number of swap pages the system brought out per
second.
-y Report TTY device activity. The following values are displayed:
rcvin/s
Number of receive interrupts per second for current
serial line. Serial line number is given in the TTY col‐
umn.
xmtin/s
Number of transmit interrupts per second for current
serial line.
framerr/s
Number of frame errors per second for current serial
line.
prtyerr/s
Number of parity errors per second for current serial
line.
brk/s
Number of breaks per second for current serial line.
ovrun/s
Number of overrun errors per second for current serial
line.
Note that with recent 2.6 kernels, these statistics can be
retrieved only by root.
ENVIRONMENT
The sar command takes into account the following environment variables:
S_TIME_FORMAT
If this variable exists and its value is ISO then the current
locale will be ignored when printing the date in the report
header. The sar command will use the ISO 8601 format (YYYY-MM-
DD) instead.
S_TIME_DEF_TIME
If this variable exists and its value is UTC then sar will save
its data in UTC time (data will still be displayed in local
time). sar will also use UTC time instead of local time to
determine the current daily data file located in the /var/log/sa
directory. This variable may be useful for servers with users
located across several timezones.
EXAMPLESsar-u 2 5
Report CPU utilization for each 2 seconds. 5 lines are dis‐
played.
sar-I 14 -o int14.file 2 10
Report statistics on IRQ 14 for each 2 seconds. 10 lines are
displayed. Data are stored in a file called int14.file.
sar-r -n DEV -f /var/log/sa/sa16
Display memory and network statistics saved in daily data file
'sa16'.
sar-A
Display all the statistics saved in current daily data file.
BUGS
/proc filesystem must be mounted for the sar command to work.
All the statistics are not necessarily available, depending on the ker‐
nel version used.
FILES
/var/log/sa/sadd
Indicate the daily data file, where the dd parameter is a number
representing the day of the month.
/proc contains various files with system statistics.
AUTHOR
Sebastien Godard (sysstat <at> orange.fr)
SEE ALSOsadc(8), sa1(8), sa2(8), sadf(1), isag(1), pidstat(1), mpstat(1),
iostat(1), vmstat(8)
http://pagesperso-orange.fr/sebastien.godard/
Linux JULY 2008 SAR(1)
