Master Linux System Monitoring with sar: Install, Commands, and Real‑World Examples

Overview

The sar (System Activity Reporter) utility, part of the sysstat package, collects and reports a wide range of Linux system activity data, including file I/O, system calls, disk I/O, CPU efficiency, memory usage, process activity, and IPC statistics.

Installation

On Ubuntu, install the package with: apt-get install sysstat After installation, the first sar run may fail because the data file has not been created. Fix it by enabling data collection:

chmod o+w /etc/default/sysstat
vim /etc/default/sysstat

Command Syntax

The general syntax is sar [options] [interval] [count]. Common options include:

-a  : all reports combined
-A  : all reports
-B  : paging statistics
-b  : I/O and transfer rates
-c  : process statistics per second
-d  : block device statistics
-F [MOUNT] : filesystem statistics
-H  : swap space utilization
-I {interrupt|SUM|ALL|XALL} : interrupt information
-n  : network statistics
-P  : CPU selection
-q  : queue length and average load
-R  : memory page statistics
-r [ALL] : memory and swap statistics
-S  : swap utilization information
-u [ALL] : CPU usage statistics
-v  : inode, file, and kernel table statistics
-W  : system swap activity
-w  : task creation and context switches
-y  : terminal device activity

CPU Information

CPU utilization, load, and interrupts can be examined with: # sar -u 1 1 Typical output fields:

%user – CPU time spent in user space

%nice – CPU time for processes with altered priority

%system – CPU time in kernel space

%iowait – Time spent waiting for I/O

%steal – CPU stolen by virtual machines

%idle – Idle CPU time

High %iowait indicates I/O bottlenecks; low %idle suggests heavy CPU usage.

# sar -p 1 3   # per‑CPU statistics

# sar -q 1 1   # load average and run queue length

Memory Information

Memory usage is reported with sar -r (or -R on some versions): # sar -r 1 1 Key fields:

kbmemfree – free memory (KB)

kbmemused – used memory (excluding kernel)

%memused – percentage of used memory

kbbuffers – kernel buffer memory

kbcached – kernel page cache

kbcommit – minimum memory required for stable operation (RAM + swap)

Swap statistics are available via sar -S (usage) and sar -W (activity):

# sar -S 1 1   # swap usage
# sar -W       # swap activity

I/O Information

Disk I/O can be monitored with sar -b (transfer rates) and sar -d (device statistics):

# sar -b 1 2   # I/O transfer rates
# sar -d 1    # per‑device I/O details

Important fields include tps, rtps, wtps, bread/s, and bwrtn/s.

Network Information

Network statistics are obtained with the -n option. The most commonly used sub‑option is DEV for interface metrics: # sar -n DEV 1 1 Fields such as rxpck/s, txpck/s, rxkB/s, and txkB/s show packet and byte rates. Error statistics are available via sar -n EDEV, socket counts via sar -n SOCK, and TCP specifics via sar -n TCP.

ksar – Graphical Front‑End

ksar is a Java‑based GUI that visualizes sar data without separate data collection. Install Java (JDK 8) first, then download and unzip ksar:

wget http://jaist.dl.sourceforge.net/project/ksar/ksar/5.0.6/ksar-5.0.6.zip
unzip ksar-5.0.6.zip
sh run.sh

After launching ksar, use Data → Run local command and execute sar -A to load all available metrics, which are then displayed as interactive charts.

The graphical view makes it easy to spot performance trends and bottlenecks across CPU, memory, I/O, and network subsystems.