Learn the UNIX/Linux command line
Home Man Pages
SAR(1) Linux User's Manual SAR(1)
NAME
sar - Collect, report, or save system activity information.
SYNOPSIS
sar [ -A ] [ -b ] [ -B ] [ -c ] [ -d ] [ -H ] [ -h ] [ -i interval ] [
-q ] [ -r ] [ -R ] [ -t ] [ -u ] [ -v ] [ -V ] [ -w ] [ -W ] [ -y ] [
-n { DEV | EDEV | SOCK | FULL } ] [ -x { pid | SELF | ALL } ] [ -X {
pid | SELF | ALL } ] [ -I { irq | SUM | ALL | XALL } ] [ -P { cpu |
ALL } ] [ -o [ filename ] | -f [ filename ] ] [ -s [ hh:mm:ss ] ] [ -e
[ hh:mm:ss ] ] [ interval [ count ] ]
DESCRIPTION
The sar command writes to standard output the contents of selected
cumulative activity counters in the operating system. The accounting
system, based on the values in the count and interval parameters,
writes information the specified number of times spaced at the speci-
fied intervals in seconds. If the interval parameter is set to zero,
the sar command displays the average statistics for the time since the
system was started. The default value for the count parameter is 1. If
its value is set to zero, then reports are generated continuously.
The collected data can also be saved in the file specified by the -o
filename flag, in addition to being displayed onto the screen. If
filename is omitted, sar uses the standard system activity daily data
file, the /var/log/sa/sadd file, where the dd parameter indicates the
current day.
The sar command extracts and writes to standard output records previ-
ously saved in a file. This file can be either the one specified by
the -f flag or, by default, the standard system activity daily data
file.
Without the -P flag, the sar command reports system-wide (global among
all processors) statistics, which are calculated as averages for val-
ues expressed as percentages, and as sums otherwise. If the -P flag is
given, the sar command reports activity which relates to the specified
processor or processors. If -P ALL is given, the sar command reports
statistics for each individual processor and global statistics among
all processors.
You can select information about specific system activities using
flags. Not specifying any flags selects only CPU activity. Specifying
the -A flag is equivalent to specifying -bBcdqrRuvwWy -I SUM -n FULL
-P ALL.
The default version of the sar command (CPU utilization report) might
be one of the first facilities the user runs to begin system activity
investigation, because it monitors major system resources. If CPU uti-
lization is near 100 percent (user + nice + system), the workload sam-
pled is CPU-bound.
If multiple samples and multiple reports are desired, it is convenient
to specify an output file for the sar command. Run the sar command as
a background process. The syntax for this is:
sar -o data.file interval count >/dev/null 2>&1 &
All data is captured in binary form and saved to a file (data.file).
The data can then be selectively displayed with the sar command using
the -f option. Set the count parameter to select records at count sec-
ond intervals. If this parameter is not set, all the records saved in
the file will be selected. Collection of data in this manner is use-
ful to characterize system usage over a period of time and determine
peak usage hours.
Note: The sar command only reports on local activities.
OPTIONS
-A This is equivalent to specifying -bBcdqrRuvwWy -I SUM -n FULL
-P ALL.
-b Report I/O and transfer rate statistics. This option works only
with kernels older than 2.5. The following values are dis-
played:
tps
Total number of transfers per second that were issued to
the physical disk. A transfer is an I/O request to the
physical disk. Multiple logical requests can be combined
into a single I/O request to the disk. A transfer is of
indeterminate size.
rtps
Total number of read requests per second issued to the
physical disk.
wtps
Total number of write requests per second issued to the
physical disk.
bread/s
Total amount of data read from the drive in blocks per
second. Blocks are equivalent to sectors with 2.4 ker-
nels and newer and therefore have a size of 512 bytes.
With older kernels, a block is of indeterminate size.
bwrtn/s
Total amount of data written to the drive in blocks per
second.
-B Report paging statistics. The following values are displayed:
pgpgin/s
Total number of kilobytes the system paged in from disk
per second.
pgpgout/s
Total number of kilobytes the system paged out to disk
per second.
fault/s
Number of page faults (major + minor) made by the system
per second (post 2.5 kernels only). This is not a count
of page faults that generate I/O, because some page
faults can be resolved without I/O.
majflt/s
Number of major faults the system has made per second,
those which have required loading a memory page from
disk (post 2.5 kernels only).
-c Report process creation activity.
proc/s
Total number of processes created per second.
-d Report activity for each block device (kernels 2.4 and newer
only). When data is displayed, the device specification dev m-
n is generally used ( DEV column). m is the major number of
the device. With recent kernels (post 2.5), n is the minor
number of the device, but is only a sequence number with pre
2.5 kernels.
tps
Indicate the number of transfers per second that were
issued to the device. Multiple logical requests can be
combined into a single I/O request to the device. A
transfer is of indeterminate size.
rd_sec/s
Number of sectors read from the device. The size of a
sector is 512 bytes.
wr_sec/s
Number of sectors written to the device. The size of a
sector is 512 bytes.
-e hh:mm:ss
Set the ending time of the report. The default ending time is
18:00:00. Hours must be given in 24-hour format. This option
can be used only when data are read from or written to a file
(options -f or -o ). Note that if you also use -h option, end-
ing time will have to be given in UTC (Coordinated Universal
Time).
-f filename
Extract records from filename (created by the -o filename
flag). The default value of the filename parameter is the cur-
rent daily data file, the /var/log/sa/sadd file. The -f option
is exclusive of the -o option.
-h When reading data from a file, print its contents in a format
that can easily be handled by pattern processing commands like
awk. The output consists of fields separated by a tab. Each
record contains the hostname of the host where sar was run, the
interval value (or -1 if not applicable), the timestamp (UTC
value - Coordinated Universal Time) in seconds from the epoch,
the device name (or - if not applicable), the field name and
its value.
-H When reading data from a file, print its contents in a format
that can easily be ingested by a relational database system.
The output consists of fields separated by a semicolon. Each
record contains the hostname of the host where sar was run, the
interval value (or -1 if not applicable), the sar timestamp in
a form easily acceptable by most databases, and additional
semicolon separated data fields as specified by other sar com-
mand line options. Note that the timestamp is displayed in UTC
(Coordinated Universal Time) unless option -t is used. In this
latter case, the timestamp is displayed in local time.
-i interval
Select data records at seconds as close as possible to the num-
ber specified by the interval parameter.
-I irq | SUM | ALL | XALL
Report statistics for a given interrupt. irq is the interrupt
number. The SUM keyword indicates that the total number of
interrupts received per second is to be displayed. The ALL key-
word indicates that statistics from the first 16 interrupts are
to be reported, whereas the XALL keyword indicates that statis-
tics from all interrupts, including potential APIC interrupt
sources, are to be reported.
-n DEV | EDEV | SOCK | FULL
Report network statistics.
With the DEV keyword, statistics from the network devices are
reported. The following values are displayed:
IFACE
Name of the network interface for which statistics are
reported.
rxpck/s
Total number of packets received per second.
txpck/s
Total number of packets transmitted per second.
rxbyt/s
Total number of bytes received per second.
txbyt/s
Total number of bytes transmitted per second.
rxcmp/s
Number of compressed packets received per second (for
cslip etc.).
txcmp/s
Number of compressed packets transmitted per second.
rxmcst/s
Number of multicast packets received per second.
With the EDEV keyword, statistics on failures (errors) from the
network devices are reported. The following values are dis-
played:
IFACE
Name of the network interface for which statistics are
reported.
rxerr/s
Total number of bad packets received per second.
txerr/s
Total number of errors that happened per second while
transmitting packets.
coll/s
Number of collisions that happened per second while
transmitting packets.
rxdrop/s
Number of received packets dropped per second because of
a lack of space in linux buffers.
txdrop/s
Number of transmitted packets dropped per second because
of a lack of space in linux buffers.
txcarr/s
Number of carrier-errors that happened per second while
transmitting packets.
rxfram/s
Number of frame alignment errors that happened per sec-
ond on received packets.
rxfifo/s
Number of FIFO overrun errors that happened per second
on received packets.
txfifo/s
Number of FIFO overrun errors that happened per second
on transmitted packets.
With the SOCK keyword, statistics on sockets in use are
reported. The following values are displayed:
totsck
Total number of used sockets.
tcpsck
Number of TCP sockets currently in use.
udpsck
Number of UDP sockets currently in use.
rawsck
Number of RAW sockets currently in use.
ip-frag
Number of IP fragments currently in use.
The FULL keyword is equivalent to specifying all the keywords
above and therefore all the network activities are reported.
-o filename
Save the readings in the file in binary form. Each reading is
in a separate record. The default value of the filename parame-
ter is the current daily data file, the /var/log/sa/sadd file.
The -o option is exclusive of the -f option.
-P cpu | ALL
Report per-processor statistics for the specified processor or
processors. Specifying the ALL keyword reports statistics for
each individual processor, and globally for all processors. Of
the flags which specify the statistics to be reported, only the
-u and -I SUM flags are meaningful with the -P flag. Note that
processor 0 is the first processor.
-q Report queue length and load averages. The following values are
displayed:
runq-sz
Run queue length (number of processes waiting for run
time).
plist-sz
Number of processes in the process list.
ldavg-1
System load average for the last minute.
ldavg-5
System load average for the past 5 minutes.
ldavg-15
System load average for the past 15 minutes.
-r Report memory and swap space utilization statistics. The fol-
lowing values are displayed:
kbmemfree
Amount of free memory available in kilobytes.
kbmemused
Amount of used memory in kilobytes. This does not take
into account memory used by the kernel itself.
%memused
Percentage of used memory.
kbbuffers
Amount of memory used as buffers by the kernel in kilo-
bytes.
kbcached
Amount of memory used to cache data by the kernel in
kilobytes.
kbswpfree
Amount of free swap space in kilobytes.
kbswpused
Amount of used swap space in kilobytes.
%swpused
Percentage of used swap space.
kbswpcad
Amount of cached swap memory in kilobytes. This is mem-
ory that once was swapped out, is swapped back in but
still also is in the swap area (if memory is needed it
doesn't need to be swapped out again because it is
already in the swap area. This saves I/O).
-R Report memory statistics. The following values are displayed:
frmpg/s
Number of memory pages freed by the system per second.
A negative value represents a number of pages allocated
by the system. Note that a page has a size of 4 kB or 8
kB according to the machine architecture.
bufpg/s
Number of additional memory pages used as buffers by the
system per second. A negative value means fewer pages
used as buffers by the system.
campg/s
Number of additional memory pages cached by the system
per second. A negative value means fewer pages in the
cache.
-s hh:mm:ss
Set the starting time of the data, causing the sar command to
extract records time-tagged at, or following, the time speci-
fied. The default starting time is 08:00. Hours must be given
in 24-hour format. This option can be used only when data are
read from a file (option -f ). Note that if you also use -h
option, starting time will have to be given in UTC (Coordinated
Universal Time).
-t When reading data from a daily data file, indicate that sar
should display the timestamps in the original locale time of
the data file creator. Without this option, the sar command
displays the timestamps in the user locale time. When this
option is used together with option -H, the timestamp is
displayed in local time instead of UTC (Coordinated Universal
Time). This option is ignored when option -h is used.
-u Report CPU utilization. The following values are displayed:
%user
Percentage of CPU utilization that occurred while exe-
cuting at the user level (application).
%nice
Percentage of CPU utilization that occurred while exe-
cuting at the user level with nice priority.
%system
Percentage of CPU utilization that occurred while exe-
cuting at the system level (kernel).
%iowait
Percentage of time that the CPU or CPUs were idle during
which the system had an outstanding disk I/O request.
%idle
Percentage of time that the CPU or CPUs were idle and
the system did not have an outstanding disk I/O request.
-v Report status of inode, file and other kernel tables. The fol-
lowing values are displayed:
dentunusd
Number of unused cache entries in the directory cache.
file-sz
Number of used file handles.
inode-sz
Number of used inode handlers.
super-sz
Number of super block handlers allocated by the kernel.
%super-sz
Percentage of allocated super block handlers with regard
to the maximum number of super block handlers that Linux
can allocate.
dquot-sz
Number of allocated disk quota entries.
%dquot-sz
Percentage of allocated disk quota entries with regard
to the maximum number of cached disk quota entries that
can be allocated.
rtsig-sz
Number of queued RT signals.
%rtsig-sz
Percentage of queued RT signals with regard to the maxi-
mum number of RT signals that can be queued.
-V Print version number and usage then exit.
-w Report system switching activity.
cswch/s
Total number of context switches per second.
-W Report swapping statistics. The following values are displayed:
pswpin/s
Total number of swap pages the system brought in per
second.
pswpout/s
Total number of swap pages the system brought out per
second.
-x pid | SELF | ALL
Report statistics for a given process. pid is the process
identification number. The SELF keyword indicates that statis-
tics are to be reported for the sar process itself, whereas the
ALL keyword indicates that statistics are to be reported for
all the system processes. All these statistics cannot be saved
to a file. So this option will be ignored whenever -o option
is used. At the present time, no more than 256 processes can
be monitored simultaneously.
The following values are displayed:
minflt/s
Total number of minor faults the process has made per
second, those which have not required loading a memory
page from disk.
majflt/s
Total number of major faults the process has made per
second, those which have required loading a memory page
from disk.
%user
Percentage of CPU used by the process while executing at
the user level (application).
%system
Percentage of CPU used by the process while executing at
the system level (kernel).
nswap/s
Number of pages from the process address space the sys-
tem has swapped out per second.
CPU
Processor number to which the process is attached.
-X pid | SELF | ALL
Report statistics for the child processes of the process whose
PID is pid . The SELF keyword indicates that statistics are to
be reported for the child processes of the sar process itself,
whereas the ALL keyword indicates that statistics are to be
reported for all the child processes of all the system pro-
cesses. All these statistics cannot be saved to a file. So
this option will be ignored whenever -o option is used. At the
present time, no more than 256 processes can be monitored
simultaneously. The following values are displayed:
cminflt/s
Total number of minor faults the child processes have
made per second, those which have not required loading a
memory page from disk.
cmajflt/s
Total number of major faults the child processes have
made per second, those which have required loading a
memory page from disk.
%cuser
Percentage of CPU used by the child processes while exe-
cuting at the user level (application).
%csystem
Percentage of CPU used by the child processes while exe-
cuting at the system level (kernel).
cnswap/s
Number of pages from the child process address spaces
the system has swapped out per second.
-y Report TTY device activity. The following values are displayed:
rcvin/s
Number of receive interrupts per second for current
serial line. Serial line number is given in the TTY col-
umn.
xmtin/s
Number of transmit interrupts per second for current
serial line.
Note that with recent 2.6 kernels, these statistics can be
retrieved only by root.
ENVIRONMENT
The sar command takes into account the following environment variable:
S_TIME_FORMAT
If this variable exists and its value is ISO then the current
locale will be ignored when printing the date in the report
header. The sar command will use the ISO 8601 format (YYYY-MM-
DD) instead.
EXAMPLES
sar -u 2 5
Report CPU utilization for each 2 seconds. 5 lines are dis-
played.
sar -I 14 -o int14.file 2 10
Report statistics on IRQ 14 for each 2 seconds. 10 lines are
displayed. Data are stored in a file called int14.file.
sar -r -n DEV -f /var/log/sa/sa16
Display memory, swap space and network statistics saved in
daily data file 'sa16'.
sar -A
Display all the statistics saved in current daily data file.
BUGS
/proc filesystem must be mounted for the sar command to work.
All the statistics are not necessarily available, depending on the
kernel version used.
FILES
/var/log/sa/sadd
Indicate the daily data file, where the dd parameter is a
number representing the day of the month.
/proc contains various files with system statistics.
AUTHOR
Sebastien Godard (sysstat <at> wanadoo.fr)
SEE ALSO
sadc(8), sa1(8), sa2(8), isag(1), mpstat(1), iostat(1), vmstat(8)
http://perso.wanadoo.fr/sebastien.godard/
Linux JUNE 2004 SAR(1)
UNIX/Linux commands referenced on this page: