Master Linux Performance: Using sar to Identify System Bottlenecks

12. sar – A Powerful Tool for Finding System Bottlenecks

sar (System Activity Reporter) samples the current state of a Linux system and records extensive performance data with minimal load. It can continuously collect samples, store results in files, and report on 14 major areas such as CPU, memory, I/O, processes, and IPC.

sar is one of the most comprehensive Linux performance analysis tools and is widely used. It has two main usage modes:

Review historical statistics (default).

Periodically view current data.

12.1 Review Historical Statistics

By default sar shows data from the most recent midnight. To view older reports, read the sa files under /var/log/sysstat/. Example:

$ sar -f /var/log/sysstat/sa28 | head
$ sar -r -f /var/log/sysstat/sa28

12.2 Viewing CPU Utilization

Use sar -u to display CPU usage percentages.

The columns represent:

%user – CPU time spent in user mode.

%nice – CPU time spent on processes with altered priority.

%system – CPU time spent in system mode.

%iowait – Time waiting for I/O.

%steal – Time stolen by virtualized environments.

%idle – Idle CPU time.

12.3 Viewing Average Load

Use sar -q to see run queue length, process count, and load averages (1, 5, and 15 minutes).

12.4 Viewing Memory Usage

Use sar -r to report physical memory statistics such as kbmemfree, kbmemused, %memused, kbbuffers, kbcached, kbcommit, and %commit.

12.5 Viewing Paging Activity

Use sar -W to monitor swap activity (pswpin/s and pswpout/s), which can indicate memory pressure.

Combine multiple sar options to pinpoint bottlenecks: CPU ( sar -u, sar -q), memory ( sar -B, sar -r, sar -W), I/O ( sar -b, sar -u, sar -d).

12.6 Installation

Install the sysstat package (e.g., apt-get install sysstat).

Enable data collection by setting ENABLED="true" in /etc/default/sysstat.

Start the service: /etc/init.d/sysstat start.

12.7 sar Options Overview

-A – Summarize all reports

-a – Report file read/write activity

-B – Report buffer cache usage

-b – Report I/O statistics

-c – Report system call usage

-d – Report disk activity

-g – Report serial line activity

-h – Report buffer statistics

-m – Report IPC message queues and semaphores

-n – Report network cache usage

-p – Report paging activity

-q – Report run queue and load averages

-R – Report process activity

-r – Report memory usage

-u – Report CPU utilization

-v – Report process, inode, file, and lock table status

-w – Report swapping activity

-y – Report TTY device activity