Master Linux Monitoring with sar: Guide to CPU, Memory, I/O, and Network Metrics

Introduction

The sar (System Activity Reporter) command is a powerful Linux tool for collecting and displaying a wide range of system performance metrics, often considered the pinnacle of command‑line monitoring due to its extensive options.

Basic Syntax and Parameters

sar

arguments are divided into four parts; the only mandatory part is the metric type (e.g., -n for network). The optional sections include sub‑type, interval in seconds, and count of samples.

Metric type (e.g., -n for network).

Sub‑type (e.g., DEV for device statistics).

Interval in seconds (e.g., 1).

Number of samples (e.g., 2).

Example command: # sar -n DEV 1 2 Typical output is a tidy two‑dimensional table that can be processed with sed or awk.

CPU Monitoring

Three common CPU metrics:

Utilization: sar -u 1 1 Load and run‑queue length: sar -q 1 1 Interrupts:

sar -I SUM 1 2

# sar -u 1 1
03:37:39 PM   CPU   %user %nice %system %iowait %steal %idle
03:37:40 PM   all    0.25   0.50   0.50    0.00    0.00  98.75

Memory Monitoring

Key memory metrics include physical, virtual, and kernel memory. Useful commands:

Memory utilization: sar -r 1 1 Swap usage: sar -S 1 1 Kernel slab info: sar -v 1 Paging activity:

sar -B

# sar -r 1 1
03:48:39 PM kbmemfree kbavail kbmemused %memused kbbuffers kbcached kbcommit %commit kbactive kbinact kbdirty
03:48:40 PM 1663884 2650804 6057692 78.45 0 1001040 6954428 90.06 4915476 582184 100

I/O Monitoring

Basic I/O statistics are obtained with sar -b. For detailed device statistics, use sar -d.

# sar -b 1 2
04:17:25 PM   tps   rtps   wtps   bread/s   bwrtn/s
04:17:26 PM   6.00   4.00   2.00   32.00    23.00

Network Monitoring

The most frequently used network sub‑type is DEV, which reports per‑interface traffic. All network metrics are accessed via sar -n.

# sar -n DEV 1 2
03:10:29 PM IFACE rxpck/s txpck/s rxkB/s txkB/s ...
03:10:30 PM lo    30.00   30.00   2.09   2.09 ...

Installation and First Run

sar

belongs to the sysstat package. Install it with: yum install sysstat After installation, the first execution may report “Cannot open /var/log/sa/saXX: No such file or directory” because data collection has not yet occurred. Run the command again after a short interval.

Exporting Historical Data

Historical records are stored in /var/log/sa. To export a day's data: sar -A -f /var/log/sa/sa21 > monitor The resulting monitor file can be visualized with tools such as kSar, a Java‑based GUI.

Conclusion

With sar, administrators gain comprehensive, historical insight into CPU, memory, I/O, and network performance, surpassing ad‑hoc tools like top or iostat. Mastering its syntax and output formats enables precise troubleshooting and capacity planning.