The sar command is a handy tool for monitoring system performance on Linux. It can report CPU usage, memory consumption, network activity, and more. System administrators and DevOps engineers use sar to track resource usage and troubleshoot system issues.

This guide will show you how to install and use the sar command to gather system resource stats.

Installing the sar Command

The sar command is part of the sysstat package, which needs to be installed before you can start using sar. The installation process varies depending on the Linux distribution you’re using.

On Ubuntu/Debian:

To install sysstat on Ubuntu or Debian-based systems, run the following commands:

apt-get update
apt-get install sysstat

Once installed, you need to enable the sysstat data collection process:

systemctl enable sysstat
systemctl start sysstat

The sysstat service will now automatically start at boot and collect data every 10 minutes by default.

On CentOS/Fedora:

On CentOS or Fedora-based systems, install sysstat using the following command:

yum install sysstat

Again, you’ll need to enable and start the service:

systemctl enable sysstat
systemctl start sysstat

Basic Syntax and Options

The sar command offers a variety of options that allow you to collect and report system statistics over a specific interval and for a specific count. The general syntax for the sar command is as follows:

sar [options] [interval] [count]

Explanation:

  • interval: The time between each data sample, in seconds.
  • count: The number of samples to be collected.

For example, if you want to collect CPU usage statistics every 5 seconds for a total of 3 times, you would run:

sar -u 5 3

Output:

Linux 6.5.0-35-generic (ubuntupc) 	09/10/2024 	_x86_64_	(4 CPU)

09:13:48 AM     CPU     %user     %nice   %system   %iowait    %steal     %idle
09:13:53 AM     all      8.83      0.00      4.00      0.62      0.00     86.56
09:13:58 AM     all     10.40      0.00      4.39      0.37      0.00     84.85
09:14:03 AM     all      9.68      0.00      3.31      0.36      0.00     86.65
Average:        all      9.63      0.00      3.90      0.45      0.00     86.02

Here are some commonly used options for sar:

  • -u: Reports CPU usage statistics.
  • -r: Reports memory and swap space statistics.
  • -n DEV: Reports network activity
  • -b: Reports disk I/O statistics.

Monitoring CPU Usage with sar

One of the most common use cases of sar is to monitor CPU usage. The -u option shows how much CPU time is spent on different types of processes, such as user processes, system processes, and idle time. It also indicates how much time the CPU spends waiting for I/O operations.

Run the following command to monitor CPU usage.

sar -u 1 5

Output:

Linux 6.5.0-35-generic (ubuntupc) 	09/10/2024 	_x86_64_	(4 CPU)

09:16:21 AM     CPU     %user     %nice   %system   %iowait    %steal     %idle
09:16:22 AM     all     11.52      0.00      3.40      0.00      0.00     85.08
09:16:23 AM     all      4.62      0.00      2.31      0.51      0.00     92.56
09:16:24 AM     all      4.10      0.00      2.31      0.26      0.00     93.33
09:16:25 AM     all      3.09      0.00      2.32      0.26      0.00     94.33

Here’s what each column means:

  • %user: Percentage of CPU time spent on user processes (non-kernel).
  • %system: Time spent on system (kernel) processes.
  • %iowait: Time spent waiting for I/O operations to complete.
  • %idle: Time when the CPU is idle.

Checking Memory Usage with sar

The sar -r command allows you to monitor memory usage, providing insights into both physical memory (RAM) and swap space.

Run the following command to monitor memory usage.

sar -r 1 3

Output:

09:17:46 AM kbmemfree   kbavail kbmemused  %memused kbbuffers  kbcached  kbcommit   %commit  kbactive   kbinact   kbdirty
09:17:47 AM    233660   1787928   4811984     60.78     66284   2413060  28737052    286.96   3526444   3294540      5628
09:17:48 AM    241400   1795668   4809148     60.74     66284   2408156  28731948    286.91   3527020   3294540      5456
09:17:49 AM    241472   1795740   4809288     60.75     66284   2407952  28733012    286.92   3528096   3294540      5392
Average:       238844   1793112   4810140     60.76     66284   2409723  28734004    286.93   3527187   3294540      5492

Here’s what each column represents:

  • kbmemfree: Free memory in kilobytes.
  • kbmemused: Used memory in kilobytes.
  • %memused: Percentage of memory used.
  • kbbuffers: Memory used by kernel buffers.
  • kbcached: Memory used by the page cache.
  • kbcommit: Committed memory (the amount of memory reserved for processes).

Analyzing Network Activity with sar

The sar -n DEV option shows you how much data is being transferred over your network interfaces.

Run the following command to monitor network activity.

sar -n DEV 1 3

Output:

12:03:01 AM   IFACE   rxpck/s   txpck/s   rxkB/s   txkB/s   rxcmp/s  txcmp/s
12:03:02 AM   eth0      34.03      12.12     4.22      2.56     0.00      0.00
12:03:03 AM   eth0      32.43      14.01     4.35      3.01     0.00      0.00

Explanation:

  • rxpck/s: Number of packets received per second.
  • txpck/s: Number of packets transmitted per second.
  • rxkB/s: Kilobytes received per second.
  • txkB/s: Kilobytes transmitted per second.

Monitoring Disk I/O with sar

The sar -b command provides detailed information on disk I/O activities, such as the number of reads and writes per second, and the amount of data read or written.

Run the following command to monitor disk I/O.

sar -b 1 3

Output:

09:20:41 AM       tps      rtps      wtps      dtps   bread/s   bwrtn/s   bdscd/s
09:20:42 AM    371.00      0.00    371.00      0.00      0.00   4128.00      0.00
09:20:43 AM      0.00      0.00      0.00      0.00      0.00      0.00      0.00
09:20:44 AM      0.00      0.00      0.00      0.00      0.00      0.00      0.00
Average:       123.67      0.00    123.67      0.00      0.00   1376.00      0.00

Explanation of columns:

  • tps: Total transactions per second.
  • rtps: Read transactions per second.
  • wtps: Write transactions per second.
  • bread/s: Bytes read per second.
  • bwrtn/s: Bytes written per second.

Scheduling sar to Run at Intervals

You can automate monitoring process by scheduling sar using cron jobs. This allows you to gather long-term performance data for later analysis.

To schedule sar to collect system resource stats every hour, edit your crontab file:

crontab -e

Add the following line to schedule data collection every hour:

0 * * * * /usr/lib/sysstat/sa1 1 1

This command tells sar to collect one sample per hour and store it in /var/log/sa/. You can view this historical data by using the -f option with sar:

sar -f /var/log/sa/sa10

This allows you to analyze system performance over time and detect any trends or anomalies.

Conclusion

The sar command is a powerful and flexible tool for monitoring system performance in Linux. It provides detailed reports on CPU, memory, network, and disk usage, helping system administrators identify and resolve performance issues. You should use sar a regular part of your system monitoring toolkit for improved system health and efficiency. You can try sar to monitor system resource usage on VPS hosting from Atlantic.Net!