Detailed Guide to the sar Command for System Performance Monitoring

The sar (System Activity Reporter) command can generate reports on file I/O, system calls, disk I/O, CPU efficiency, memory usage, process activity, and IPC-related activities.

Command format: sar [options] [-A] [-o file] t [n] where t is the sampling interval, n the number of samples (default 1), and -o file stores results in binary format.

Common options include: -A: all reports combined -u: CPU usage statistics -v: inode, file and other kernel table statistics -d: activity per block device -r: memory and swap usage -b: I/O and transfer rate statistics -a: file read/write activity -c: process creation rate -R: memory paging statistics -y: terminal device activity -w: system swap activity

Example scenarios :

CPU monitoring : sample every 5 seconds for 10 times and save to a binary file. sar -u -o test_sar 5 10 Output fields include CPU (average of all CPUs), %user, %nice, %system, %iowait, %steal, and %idle, with interpretation notes for high I/O wait, low idle, etc.

Inode and file table monitoring : sar -v 5 10 Key fields: dentunusd (unused directory cache entries), file-nr (file handles), inode-nr (inode handles), pty-nr (pseudo‑terminals).

Memory and swap monitoring : sar -r 5 10 Important metrics: kbmemfree, kbmemused, %memused, kbbuffers, kbcached, kbcommit, %commit.

Memory paging monitoring : sar -B 5 10 Outputs include pgpgin/s, pgpgout/s, fault/s, majflt/s, pgfree/s, pgscank/s, pgscand/s, pgsteal/s, and %vmeff.

I/O and transfer rate monitoring : sar -b 5 10 Fields: tps, rtps, wtps, bread/s, bwrtn/s.

Process queue length and load average : sar -q 5 10 Shows runq-sz, plist-sz, ldavg-1, ldavg-5, ldavg-15.

Swap activity monitoring : sar -W 5 10 Provides pswpin/s and pswpout/s.

Device usage monitoring : sar -d 5 10 -p With -p it prints device names (e.g., sda, hdc). Important metrics: tps, rd_sec/s, wr_sec/s, avgrq-sz, avgqu-sz, await, svctm, %util. High avgqu-sz or %util near 100 % indicates saturation.

To diagnose system bottlenecks, combine relevant options: use sar -u and sar -q for CPU, sar -B, sar -r, sar -W for memory, and sar -b, sar -u, sar -d for I/O.