Master Linux Performance Monitoring with sar: A Step‑by‑Step Guide

Sar Command Overview

The sar utility reports on system activity such as CPU usage, memory consumption, disk I/O, and process queues. Its basic syntax is sar [options] [-A] [-o file] t [n] , where t is the sampling interval and n the number of samples.

Common Options

-A: all reports

-u: CPU utilization

-v: inode, file and kernel table statistics

-d: per‑device activity

-r: memory and swap usage

-b: I/O and transfer rates

-a: file read/write activity

-c: process creation rate

-R: memory paging statistics

-y: terminal device activity

-w: swap activity

1. CPU Resource Monitoring

CPU can become a bottleneck during video transcoding or other intensive workloads. Sample every 5 seconds for 10 intervals and store results in a binary file:

<code>sar -u -o test_sar 5 10</code>

Key output fields:

CPU: all – average across all CPUs

%user: time spent in user space

%nice: time spent on nice‑adjusted processes

%system: time spent in kernel space

%iowait: time waiting for I/O

%steal: time stolen by hypervisor

%idle: idle time

Interpretation tips:

High %iowait indicates I/O bottleneck.

High %idle with slow response may mean memory pressure.

Consistently low %idle (<1%) suggests CPU is the limiting resource.

2. Memory and Swap Monitoring

Use the -r option to track memory usage and detect leaks:

<code>sar -r 5 10</code>

Key fields:

kbmemfree: free memory (excluding buffers/cache)

kbmemused: used memory (including buffers/cache)

%memused: percentage of used memory

kbbuffers / kbcached: buffer and cache sizes

kbcommit: memory required to avoid swapping

%commit: commit as a percentage of total memory+swap

3. I/O and Transfer Rate Monitoring

Check disk I/O when the system feels sluggish:

<code>sar -b 5 10</code>

Important metrics:

tps: transfers per second

rtps: reads per second

wtps: writes per second

bread/s: blocks read per second

bwrtn/s: blocks written per second

4. Process Queue Length and Load Average

<code>sar -q 5 10</code>

Outputs:

runq‑sz: length of the run queue

plist‑sz: total processes and threads

ldavg‑1, ldavg‑5, ldavg‑15: 1‑, 5‑, and 15‑minute load averages

5. Swap Activity Monitoring

<code>sar -W 5 10</code>

Fields:

pswpin/s: pages swapped in per second

pswpout/s: pages swapped out per second

6. Device Utilization Monitoring

<code>sar -d 5 10 -p</code>

With -p the command prints device names (e.g., sda). Important metrics include:

tps: I/O operations per second

rd_sec/s, wr_sec/s: sectors read/written per second

avgrq‑sz: average request size

avgqu‑sz: average queue length

await: average wait time (ms)

svctm: service time (ms)

%util: percentage of time the device was busy

Interpretation notes:

Low avgqu‑sz with high %util means the device is heavily utilized.

When %util approaches 100 %, the device bandwidth is saturated.

7. Bottleneck Diagnosis

Combine relevant sar options to pinpoint issues:

Suspect CPU: use sar -u and sar -q .

Suspect memory: use sar -B , sar -r , sar -W .

Suspect I/O: use sar -b , sar -u , sar -d .