Master Linux Performance Monitoring with sar: A Complete Guide

What Is sar?

sar (System Activity Reporter) samples the current state of a Linux system and reports it as calculated data and ratios. It can continuously sample, store results in files, and has a low overhead, making it one of the most comprehensive performance analysis tools on Linux.

sar can report on 14 major aspects, including file I/O, system calls, serial ports, CPU efficiency, memory usage, process activity, and IPC activity.

Two Main Usage Modes

Retrieve past statistics (default).

Periodically view current data.

Diagnosing Bottlenecks

Combine sar options to pinpoint issues:

CPU bottlenecks: sar -u, sar -q Memory bottlenecks: sar -B, sar -r, sar -W I/O bottlenecks: sar -b, sar -u,

sar -d

Retrieving Past Statistics

By default, sar shows data from 00:00 of the current day. To view older reports, read the saved logs under /var/log/sysstat/ (files named saXX).

Example commands:

sar -f /var/log/sysstat/sa28 | head

sar -r -f /var/log/sysstat/sa28

Viewing CPU Usage

Run: sar -u 1 5 The output columns are: %user – CPU time spent in user mode. %nice – CPU time for processes with a nice value. %system – CPU time spent in kernel mode. %iowait – Time waiting for I/O. %steal – Time stolen by virtual machines. %idle – Idle CPU time.

Viewing Average Load

Run: sar -q This shows the run queue size, process list size, and load averages for 1, 5, and 15 minutes.

runq-sz

– Number of processes waiting to run. plist-sz – Number of processes and threads. ldavg-1 – 1‑minute load average. ldavg-5 – 5‑minute load average. ldavg-15 – 15‑minute load average.

Viewing Memory Usage

Run: sar -r Key fields: kbmemfree – Free memory (similar to free command). kbmemused – Used memory, including buffers and cache. %memused – Physical memory usage percentage. kbbuffers and kbcached – Buffer and cache sizes. kbcommit – Memory needed to avoid overflow (RAM + swap). %commit – Commit ratio relative to total memory (including swap).

Viewing Swap Activity

Run: sar -W Important metrics: pswpin/s – Pages swapped in per second. pswpout/s – Pages swapped out per second.

Installation and Enabling

On some Linux distributions, install the package with: apt-get install sysstat Enable data collection by editing /etc/default/sysstat and setting: ENABLED="true" Start the service:

/etc/init.d/sysstat start

sar Command Options

-A

– Summarize all reports. -a – Report file read/write activity. -B – Report additional cache usage. -b – Report buffer usage. -c – Report system call usage. -d – Report disk usage. -g – Report serial port usage. -h – Report buffer statistics. -m – Report IPC message queues and semaphores. -n – Report network cache usage. -p – Report paging activity. -q – Report run queue and swap queue lengths. -R – Report process activity. -r – Report memory usage. -u – Report CPU utilization. -v – Report process, inode, file, and lock table status. -w – Report system swap activity. -y – Report TTY device activity.