20 sar command examples in Linux [Cheat Sheet] | GoLinuxCloud (2024)

Introduction to sar command

sar is the short form for System Activity Report. sar collects, reports, or saves system activity information like CPU utilization, memory usage, I/O devices usage in the Linux system. sar command displays the average statistics for the time since the system was started. It generates the report in the output, which can also be saved in the file.

How to install sar in Linux

If sar is not already installed in the system, you can use the following command to install it.

Install sar on CentOS, Fedora and RHEL, Rocky Linux, Alma Linux

$ sudo yum install sysstat

Install sar on Ubuntu, Debian, and Linux Mint

$ sudo apt install sysstat

How to enable sar for collecting system activity

After installing sysstat, you need to enable sar service to collect system activity information. You can do this by editing the file /etc/default/sysstat. Use any of the text editors and replace the line (ENABLED="false") with "true" like below. Then press Ctrl+X to exit and save file.

It will enable sar command to collect system activity information.

After that, you need to restart the sar service using the following command.

$ systemctl restart sysstat.service

Configure cron job for sar command

sar is by default configured to collect system statistics for all the resource i.e. CPU, network, memory, disk etc at an interval of 10 minutes. We also have a cron job to create a summary of all the statistics in the midnight for every day.
To get the details of cron job configured by sar you can check /etc/cron.d/sysstat:

~]# cat /etc/cron.d/sysstat # Run system activity accounting tool every 10 minutes*/10 * * * * root /usr/lib64/sa/sa1 1 1# 0 * * * * root /usr/lib64/sa/sa1 600 6 &# Generate a daily summary of process accounting at 23:5353 23 * * * root /usr/lib64/sa/sa2 -A

You can further modify the cron job based on your requirement. The report files are by default stored under /var/log/sa or /var/log/sysstat depending upon your distribution:

~]# ls -l /var/log/sa/sa*-rw-r-----. 1 root root 2530400 Nov 1 23:50 /var/log/sa/sa01-rw-r-----. 1 root root 2530400 Nov 2 23:50 /var/log/sa/sa02-rw-r-----. 1 root root 2530400 Nov 3 23:50 /var/log/sa/sa03-rw-r-----. 1 root root 2530400 Nov 4 23:50 /var/log/sa/sa04-rw-r-----. 1 root root 2530400 Nov 5 23:50 /var/log/sa/sa05-rw-r-----. 1 root root 2530400 Nov 6 23:50 /var/log/sa/sa06...

These report files are in compressed format and you can use sar -f <file> to read the content of individual files.

Different examples to use sar command

The general syntax of sar command is:

$ sar [option] [interval] [count]

Now, let's have a look at some practical examples of sar command in Linux system.

1. Display CPU utilization statistics with sar command

-u option is used to display the CPU utilization report. TheALLkeyword indicates that all the CPU fields should be displayed.

$ sar -u [ALL]

Sample Output:

~]# sar -uLinux 4.18.0-193.19.1.2009211817.el7_8.emrs.altmvl.x86_64 (fi-758-ncs20fp2-5-cluster-01-cs-01) 11/07/2021 _x86_64_(16 CPU)12:00:01 AM CPU %user %nice %system %iowait %steal %idle12:10:01 AM all 4.44 0.00 2.52 0.88 0.00 92.1712:20:01 AM all 4.46 0.00 2.54 0.88 0.00 92.1112:30:01 AM all 4.46 0.00 2.53 0.88 0.00 92.1312:40:01 AM all 4.48 0.00 2.54 0.87 0.00 92.1012:50:01 AM all 4.49 0.00 2.55 0.88 0.00 92.07~]# sar -u ALLLinux 4.18.0-193.19.1.2009211817.el7_8.emrs.altmvl.x86_64 (fi-758-ncs20fp2-5-cluster-01-cs-01) 11/07/2021 _x86_64_(16 CPU)12:00:01 AM CPU %usr %nice %sys %iowait %steal %irq %soft %guest %gnice %idle12:10:01 AM all 4.44 0.00 1.84 0.88 0.00 0.33 0.34 0.00 0.00 92.1712:20:01 AM all 4.46 0.00 1.87 0.88 0.00 0.33 0.34 0.00 0.00 92.1112:30:01 AM all 4.46 0.00 1.85 0.88 0.00 0.33 0.34 0.00 0.00 92.1312:40:01 AM all 4.48 0.00 1.87 0.87 0.00 0.33 0.34 0.00 0.00 92.1012:50:01 AM all 4.49 0.00 1.87 0.88 0.00 0.34 0.35 0.00 0.00 92.0701:00:01 AM all 4.53 0.00 1.86 0.89 0.00 0.33 0.34 0.00 0.00 92.05

2. sar command to report CPU utilization for each N seconds

The following syntax can be used to display CPU utilization statistics for every N seconds.

$ sar -u N

Sample Output:

For example, the following command reports CPU utilization for every 2 seconds. It reports continuously until the command is terminated.

3. sar command to display memory utilization statistics

You can use -r option to view the memory utilization report with sar command. The ALL keyword displays all the memory fields in the output.

$ sar -r [ALL]

Sample Output:

~]# sar -rLinux 4.18.0-193.19.1.2009211817.el7_8.emrs.altmvl.x86_64 (fi-758-ncs20fp2-5-cluster-01-cs-01) 11/07/2021 _x86_64_(16 CPU)12:00:01 AM kbmemfree kbmemused %memused kbbuffers kbcached kbcommit %commit kbactive kbinact kbdirty12:10:01 AM 2134156 63566948 96.75 1052256 49162336 40967324 62.35 25409548 34574092 55212:20:01 AM 2195820 63505284 96.66 1052288 49126936 41028268 62.45 25386316 34535556 37212:30:01 AM 2169852 63531252 96.70 1052324 49145412 41218496 62.74 25393140 34553428 59612:40:01 AM 2279420 63421684 96.53 1052348 49111368 41170352 62.66 25319580 34518992 404

4. Display I/O and transfer rate statistics using sar command

-b option is used to report I/O and transfer rate statistics.

$ sar -b

Sample Output:

5. sar command to display statistics for the specified processor

-P option helps to report per-processor statistics for the specified processor or processors. The processor 0 is the first processor.

$ sar -P 0

Sample Output:

The ALLkeyword reports statistics for each individual processor, and globally for all processors.

$ sar -P ALL

6. sar command to view swap space utilization statistics

You can use -S option to display swap space utilization statistics.

$ sar -S

Sample Output:

7. sar command to display M reports for every N seconds

The following command displays M number of reports for every N seconds.

$ sat option N M

Sample Output:

For example, to display 7 swap space utilization reports for every 2 seconds, you can use the following command.

8. sar command to display memory swapping statistics

-W option in sar command is used to report swapping statistics.

$ sar -W

Sample Output:

pswpin/s - Total number of swap pages the system brought in per second.

pswpout/s - Total number of swap pages the system brought out per second.

9. sar command to display filesystems statistics

-F option helps to display the statistics of filesystems mounted on the device.

$ sar -F

Sample Output:

10. sar command to display network statistics

-n option is used to report network statistics.

$ sar -n keyword

Sample Output:

With theDEVkeyword, statistics from the network devices are reported.

The possible keywords are:

DEV,EDEV,NFS,NFSD,SOCK,IP,EIP,ICMP,EICMP,TCP,ETCP,UDP,SOCK6,IP6,EIP6,ICMP6,EICMP6andUDP6.

11. Display all network statistics using sar command

TheALL keyword with -n is equivalent to specifying all the keywords above and therefore all the network activities are reported.

$ sar -n ALL

Sample Output:

~]# sar -n ALL 12:10:01 AM eth6 0.02 0.00 0.00 0.00 0.00 0.00 0.0012:10:01 AM eth3 11.20 10.28 2.71 2.42 0.00 0.00 0.0012:10:01 AM eth7 1.31 0.00 0.05 0.00 0.00 0.00 0.0012:10:01 AM eth5 0.98 0.00 0.05 0.00 0.00 0.00 0.0012:10:01 AM eth0 1.33 1.44 0.36 0.14 0.00 0.00 0.0012:10:01 AM eth1 0.00 0.00 0.00 0.00 0.00 0.00 0.0012:10:01 AM eth2 1462.06 1318.52 2242.77 3145.06 0.00 0.00 0.0012:10:01 AM eth4 0.98 0.00 0.05 0.00 0.00 0.00 0.0012:10:01 AM eth8 0.00 0.00 0.00 0.00 0.00 0.00 0.0012:20:01 AM eth6 0.00 0.00 0.00 0.00 0.00 0.00 0.00...

12. sar command to display block devices statistics

-d option is used to report activity for each block device. When data is displayed, the device specificationdevm-n is generally used (DEVcolumn).m is the major number of the device and n is the minor number of the device.

$ sar -d

Sample Output:

13. Display queue length and load averages using sar command

You can use -q option to display the report about queue length and load averages.

$ sar -q

Sample Output:

14. sar command to display paging statistics

-B option is used to report paging statistics.

$ sar -B

Sample Output:

15. Extract reports from file with sar command

-f option extracts the records from the filename. We have already explained this part at the beginning of the tutorial. The report file generated by sar using cron job can be read using sar -f command:

$ sar -f /dir/file

Sample Output:

16. sar command to report task creation and system switching activity

You can view the task creation and system switching activity using -w option with sar command.

$ sar -w [interval] [count]

Sample Output:

proc/s - Total number of tasks created per second.

cswch/s - Total number of context switches per second.

17. Display report about kernel tables using sar command

-v option displays the status of the inode, file and other kernel tables.

$ sar -v [interval] [count]

Sample Output:

Here,

• dentunusd- Number of unused cache entries in the directory cache.
• file-nr- Number of file handles used by the system.
• inode-nr- Number of inode handlers used by the system.
• pty-nr- Number of pseudo-terminals used by the system.

18. Report statistics for a given interrupt with sar command

-I option is used to display statistics for given interrupt number. intis the interrupt number.

$ sar -I int

Sample Output:

The below command displays 6 reports of 5 interrupt for every 2 seconds.

The other keywords available with -I option are:

• SUM- It displays the total number of interrupts received per second.
• ALL- It reports statistics from the first 16 interrupts.
• XALL - It displays statistics from all interrupts, including potential APIC interrupt sources.

19. sar command to display all statistics

-A option is equivalent to specifying-bBdqrRSuvwWy -I SUM -I XALL -n ALL -u ALL -P ALL.

$ sar -A

Sample Output:

~]# sar -ALinux 4.18.0-193.19.1.2009211817.el7_8.emrs.altmvl.x86_64 (fi-758-ncs20fp2-5-cluster-01-cs-01) 11/07/2021 _x86_64_(16 CPU)12:00:01 AM CPU %usr %nice %sys %iowait %steal %irq %soft %guest %gnice %idle12:10:01 AM all 4.44 0.00 1.84 0.88 0.00 0.33 0.34 0.00 0.00 92.1712:10:01 AM 0 4.63 0.00 1.83 0.82 0.00 0.27 0.39 0.00 0.00 92.0412:10:01 AM 1 4.21 0.00 1.80 0.74 0.00 0.38 0.26 0.00 0.00 92.6012:10:01 AM 2 4.70 0.00 1.93 0.63 0.00 0.33 0.26 0.00 0.00 92.1512:10:01 AM 3 4.71 0.00 1.92 0.76 0.00 0.29 0.21 0.00 0.00 92.1112:10:01 AM 4 4.41 0.00 1.92 0.89 0.00 0.43 1.88 0.00 0.00 90.4612:10:01 AM 5 4.38 0.00 1.79 0.84 0.00 0.28 0.22 0.00 0.00 92.49....

20. sar command to display power management statistics

-m option allows you to display power management reports using the following syntax.

$ sar -m keyword

Available keywords are:

• CPU - CPU instantaneous clock frequency
• FAN - Fans speed
• FREQ - CPU average clock frequency
• IN - Voltage inputs
• TEMP - Devices temperature
• USB - USB devices plugged into the system

Conclusion

In this way, we can use sar command to view reports about CPU utilization, memory utilization, I/O usage, swapping statistics, filesystems statistics, network statistics, etc. We hope you have learned the usage of sar command from this article. If you still have any confusion, please feel free to ask us in the comment section.

What’s Next

15+ iostat command examples in Linux [Cheat Sheet]

Further Reading

man page for sar command