Linux sar command Tutorial

Linux sar (System Activity Reporter) command Guide and Tutorial with Example

Installation of sar  (System Activity Reporter)  
As noted, sar is a component of the sysstat package, which is already contained in numerous distribution files and can be easily installed, depending on the distribution file, either by yum install sysstat (RHEL Based OS) or apt-get install sysstat (Debian based OS). Generally at the same time, the cron jobs will be created in /etc/cron.d/sysstat.

Functional Approach of Logging 
sa1 and sa2 will store the recorded data in the directories, /var/log/sa/ (RHEL/CentOS) or /var/log/sysstat/ (Debian). 

Displaying the recorded data using sar :- 

1) Limiting the Display Period
2) Displaying the CPU Load
3) Displaying the RAM Load
4) Displaying the Load Average
5) Displaying the I/O Transfer Rate
6) Displaying the Network Statistics
7) Displaying the Disk Statistics
8) Displaying All Values

Limiting the Display Period
sar can display either the data for the current day (which does not require any special parameters) or the data for a specific day (such as with the -f /var/log/sa/sa21 parameter).

The query period can be further limited by the following parameters:

-s [ hh:mm:ss ] - sets the starting time (such as -s 07:30:00); if a specific time is not specified, 08:00:00 will be used as the default starting time.
-s [ hh:mm:ss ] - sets the ending time (such as -s 19:30:00); if a specific time is not specified, 18:00:00 will be used as the default ending time.

Displaying the CPU Load: sar -P ALL

The values for all CPUs (-P ALL) will be displayed starting from the 24th of the current month (-f /var/log/sa/sa24).

[root@amitmaheshwari.in ~]#  sar -P ALL -f /var/log/sa/sa24
Linux 3.10.0-693.11.6.el7.x86_64 (amitmaheshwari.in)       01/23/2020      _x86_64_        (4 CPU)

06:00:01 PM     CPU     %user     %nice   %system   %iowait    %steal     %idle
06:01:01 PM     all      0.20      0.00      0.66      0.00      0.00     99.13
06:01:01 PM       0      0.13      0.00      1.18      0.00      0.00     98.68
06:01:01 PM       1      0.25      0.00      0.53      0.00      0.00     99.22

%user: This shows the total time that the processor is spending on different process 
%sys: this shows the percentage of time spend by the processor for operating system tasks(because the previous user shows the time spend for user end process)
%iowait: the name iowait itself suggests that its the time spend by processor waiting for devices(input and output)
%nice: Most of you guys must be knowing that a user can change the priority of a process in linux by changing the nice value in Linux. This table shows the time spend by CPU for process whose nice value has been changed.
%steal:  This column shows the amount to time spend by a CPU (which is virtualized), for resources from the physical CPU
%idle: This suggests the idle time spend by the processor.

Displaying the RAM Load: sar -r

The RAM values (-r) for the current day will be displayed here. A value of approximately 100 for the percentage of memory used is thoroughly positive (if swapping is not required).

[root@amitmaheshwari.in ~]#  sar -r -f /var/log/sa/sa24
Linux 3.10.0-693.11.6.el7.x86_64 (amitmaheshwari.in)       01/23/2020      _x86_64_        (4 CPU)

06:00:01 PM kbmemfree   kbavail kbmemused  %memused kbbuffers  kbcached  kbcommit   %commit  kbactive   kbinact   kbdirty
06:01:01 PM   2368244         0   5624776     70.37      5312   2712276   6682688     16.09   4722160    369652        12
06:02:01 PM   2371084         0   5621936     70.34      5312   2712308   6669276     16.06   4720628    369656        20

kbmemfree: this shows the amount of free memory
Kbmemused: memory used
%memused: percentage of memory used
kbbuffers: buffer memory used by the kernel.
kbcached: cached memory used by the kernel
all other entries for memory are swap(free,used,percentage etc)

Displaying the Load Average: sar -q

The average load values (-q) for the current day will be displayed here.

[root@amitmaheshwari.in ~]#  sar -q -f /var/log/sa/sa24
Linux 3.10.0-693.11.6.el7.x86_64 (amitmaheshwari.in)       01/23/2020      _x86_64_        (4 CPU)

06:00:01 PM   runq-sz  plist-sz   ldavg-1   ldavg-5  ldavg-15   blocked
06:01:01 PM         1       371      0.00      0.04      0.06         0
06:02:01 PM         0       367      0.00      0.04      0.05         0
06:03:01 PM         0       366      0.00      0.03      0.05         0
06:04:01 PM         0       365      0.00      0.02      0.05         0

Displaying the I/O Transfer Rate: sar -b

The I/O transfer rates (-r) for the current day will be displayed here.

[root@amitmaheshwari.in ~]#  sar -b -f /var/log/sa/sa24
Linux 3.10.0-693.11.6.el7.x86_64 (amitmaheshwari.in)       01/23/2020      _x86_64_        (4 CPU)

06:00:01 PM       tps      rtps      wtps   bread/s   bwrtn/s
06:01:01 PM      1.10      0.00      1.10      0.00     11.98
06:02:01 PM      0.75      0.00      0.75      0.00      7.99
06:03:01 PM      0.90      0.00      0.90      0.00      8.52
06:04:01 PM      0.88      0.00      0.88      0.00      9.37
06:05:01 PM      0.48      0.00      0.48      0.00      5.49

tps - Total number of transfers per second that were issued to physical devices. A transfer is an I/O request to a physical device. Multiple logical requests can be combined into a single I/O request to the device. A transfer is of indeterminate size
rtps - Total number of read requests per second issued to physical devices
wtps - Total number of write requests per second issued to physical devices
bread/s - Total amount of data read from the devices in blocks per second. Blocks are equivalent to sectors with 2.4 kernels and newer and therefore have a size of 512 bytes. With older kernels, a block is of indeterminate size.
bwrtn/s - Total amount of data written to devices in blocks per second.

Displaying the Network Statistics: sar -n DEV

The statistical network values (-n) for the current day will be displayed here.

[root@amitmaheshwari.in ~]#  sar -n DEV -f /var/log/sa/sa24
Linux 3.10.0-693.11.6.el7.x86_64 (amitmaheshwari.in)       01/23/2020      _x86_64_        (4 CPU)

06:00:01 PM     IFACE   rxpck/s   txpck/s    rxkB/s    txkB/s   rxcmp/s   txcmp/s  rxmcst/s   %ifutil
06:01:01 PM eno16777728      7.89      7.20      1.04      1.50      0.00      0.00      0.00      0.00
06:01:01 PM eno33554952      1.86      0.00      0.18      0.00      0.00      0.00      0.00      0.00
06:01:01 PM        lo      0.00      0.00      0.00      0.00      0.00      0.00      0.00      0.00
06:02:01 PM eno16777728      5.56      4.84      0.81      0.95      0.00      0.00      0.00      0.00
06:02:01 PM eno33554952      1.35      0.00      0.15      0.00      0.00      0.00      0.00      0.00

IFACE: stands for the nic card interface name
rxpck/s: this shows the total packets received per second
txpck/s:transmitted packets per second
rxcmp/s: compressed packets received
txcmp/s: compressed packets transmitted
rxmcst/s: packets multicasted per second.

Displaying the Disk Statistics:-  sar -d 

The output of sar -d shows various disk-related statistics for one measurement period. 

[root@amitmaheshwari.in ~]#  sar -d -f /var/log/sa/sa24
Linux 3.10.0-693.11.6.el7.x86_64 (amitmaheshwari.in)       01/23/2020      _x86_64_        (4 CPU)

06:00:01 PM       DEV       tps     rkB/s     wkB/s   areq-sz    aqu-sz     await     svctm     %util
06:01:01 PM    dev8-0      1.05      0.00      5.89      5.62      0.00      0.24      0.17      0.02
06:01:01 PM   dev8-16      0.05      0.00      0.10      2.00      0.00      0.00      0.00      0.00
06:01:01 PM   dev8-32      0.00      0.00      0.00      0.00      0.00      0.00      0.00      0.00
06:01:01 PM   dev8-48      0.00      0.00      0.00      0.00      0.00      0.00      0.00      0.00
06:01:01 PM  dev253-0      0.20      0.00      0.87      4.33      0.00      0.58      0.25      0.00

Displaying All Values : sar -A 

The collective values for all devices (CPU, RAM, etc.) can be displayed using sar -A.