sar - Collect, report, or save system activity informa
tion.
SYNOPSIS
sar [ -A ] [ -b ] [ -B ] [ -c ] [ -d ] [ -h ] [ -i inter
val ] [ -q ] [ -r ] [ -R ] [ -t ] [ -u ] [ -v ] [ -V ] [
-w ] [ -W ] [ -y ] [ -n { DEV | EDEV | SOCK | FULL } ] [
-x { pid | SELF | SUM | ALL } ] [ -X { pid | SELF | ALL }
] [ -I { irq | SUM | PROC | ALL | XALL } ] [ -U { cpu |
ALL } ] [ -o [ filename ] | -f [ filename ] ] [ -s [
hh:mm:ss ] ] [ -e [ hh:mm:ss ] ] [ interval [ count ] ]
DESCRIPTION
The sar command writes to standard output the contents of
selected cumulative activity counters in the operating
system. The accounting system, based on the values in the
count and interval parameters, writes information the
specified number of times spaced at the specified inter
vals in seconds. If the interval parameter is set to
zero, the sar command displays the average statistics for
the time since the system was started. The default value
for the count parameter is 1. If its value is set to zero,
then reports are generated continuously. The collected
data can also be saved in the file specified by the -o
filename flag, in addition to being displayed onto the
screen. If filename is omitted, sar uses the standard sys
tem activity daily data file, the /var/log/sa/sadd file,
where the dd parameter indicates the current day.
The sar command extracts and writes to standard output
records previously saved in a file. This file can be
either the one specified by the -f flag or, by default,
the standard system activity daily data file.
You can select information about specific system activi
ties using flags. Not specifying any flags selects only
CPU activity. Specifying the -A flag is equivalent to
specifying -bBcdqrRuvwWy -I SUM -I PROC -n FULL -U ALL.
The default version of the sar command (CPU utilization
report) might be one of the first facilities the user runs
to begin system activity investigation, because it moni
tors major system resources. If CPU utilization is near
100 percent (user + nice + system), the workload sampled
is CPU-bound.
If multiple samples and multiple reports are desired, it
is convenient to specify an output file for the sar com
mand. Run the sar command as a background process. The
syntax for this is:
sar -o data.file interval count >/dev/null 2>&1 &
(data.file). The data can then be selectively displayed
with the sar command using the -f option. Set the count
parameter to select records at count second intervals. If
this parameter is not set, all the records saved in the
file will be selected. Collection of data in this manner
is useful to characterize system usage over a period of
time and determine peak usage hours.
Note: The sar command only reports on local activi
ties.
OPTIONS
-A This is equivalent to specifying -bBcdqrRuvwWy -I
SUM -I PROC -n FULL -U ALL.
-b Report I/O and transfer rate statistics. The fol
lowing values are displayed:
tps
Total number of transfers per second that
were issued to the physical disk. A trans
fer is an I/O request to the physical disk.
Multiple logical requests can be combined
into a single I/O request to the disk. A
transfer is of indeterminate size.
rtps
Total number of read requests per second
issued to the physical disk.
wtps
Total number of write requests per second
issued to the physical disk.
bread/s
Total amount of data read from the drive in
blocks per second. A block is of indetermi
nate size.
bwrtn/s
Total amount of data written to the drive in
blocks per second.
-B Report paging statistics. The following values are
displayed:
pgpgin/s
Total number of blocks the system paged in
from disk per second.
pgpgout/s
Total number of blocks the system paged out
activepg
Number of active (recently touched) pages in
memory. Note that a page has a size of 4 KB
or 8 KB according to the machine architec
ture.
inadtypg
Number of inactive dirty (modified or poten
tially modified) pages in memory.
inaclnpg
Number of inactive clean (not modified)
pages in memory.
inatarpg
"Inactive target" number of pages. This
field is a 1-minute floating average of the
number of pages the system needs to "steal"
every second in order to satisfy memory
demand.
-c Report process creation activity.
proc/s
Total number of processes created per sec
ond.
-d Report activity for each block device (kernels 2.4
and later only). When data is displayed, the device
specification dev m-n is generally used ( DEV col
umn). m is the major number of the device, whereas
n is a distinctive number.
tps
Indicate the number of transfers per second
that were issued to the device. Multiple
logical requests can be combined into a sin
gle I/O request to the device. A transfer is
of indeterminate size.
blks/s
Number of blocks transferred from or to the
device. A block is of indeterminate size.
-e hh:mm:ss
Set the ending time of the report. The default end
ing time is 18:00:00. Hours must be given in
24-hour format. This option can be used only when
data are read from or written to a file (options -f
or -o ).
Extract records from filename (created by the -o
filename flag). The default value of the filename
parameter is the current daily data file, the
/var/log/sa/sadd file. The -f option is exclusive
of the -o option.
-h When reading data from a file, print its contents
in a format that can easily be handled by pattern
processing commands like awk. The output consists
of columns separated by a tab. The columns are: The
machine hostname, the interval value (or -1 if not
applicable), the timestamp (UST time) in seconds
from the epoch, the device name (or - if not appli
cable), the field name and its value.
-i interval
Select data records at seconds as close as possible
to the number specified by the interval parameter.
-I irq | SUM | PROC | ALL | XALL
Report statistics for a given interrupt. irq is
the interrupt number. The SUM keyword indicates
that the total number of interrupts received per
second is to be displayed. The ALL keyword indi
cates that statistics from the first 16 interrupts
are to be reported, whereas the XALL keyword indi
cates that statistics from all interrupts, includ
ing potential APIC interrupt sources, are to be
reported. Last, if you use the PROC keyword, the
number of interrupts per second received by each
processor is displayed.
-n DEV | EDEV | SOCK | FULL
Report network statistics.
With the DEV keyword, statistics from the network
devices are reported. The following values are
displayed:
IFACE
Name of the network interface for which
statistics are reported.
rxpck/s
Total number of packets received per second.
txpck/s
Total number of packets transmitted per sec
ond.
rxbyt/s
Total number of bytes received per second.
Total number of bytes transmitted per sec
ond.
rxcmp/s
Number of compressed packets received per
second (for cslip etc.).
txcmp/s
Number of compressed packets transmitted per
second.
rxmcst/s
Number of multicast packets received per
second.
With the EDEV keyword, statistics on failures
(errors) from the network devices are reported.
The following values are displayed:
IFACE
Name of the network interface for which
statistics are reported.
rxerr/s
Total number of bad packets received per
second.
txerr/s
Total number of errors that happened per
second while transmitting packets.
coll/s
Number of collisions that happened per sec
ond while transmitting packets.
rxdrop/s
Number of received packets dropped per sec
ond because of a lack of space in linux
buffers.
txdrop/s
Number of transmitted packets dropped per
second because of a lack of space in linux
buffers.
txcarr/s
Number of carrier-errors that happened per
second while transmitting packets.
rxfram/s
Number of frame alignment errors that hap
pened per second on received packets.
Number of FIFO overrun errors that happened
per second on received packets.
txfifo/s
Number of FIFO overrun errors that happened
per second on transmitted packets.
With the SOCK keyword, statistics on sockets in use
are reported. The following values are displayed:
totsck
Total number of used sockets.
tcpsck
Number of TCP sockets currently in use.
udpsck
Number of UDP sockets currently in use.
rawsck
Number of RAW sockets currently in use.
ip-frag
Number of IP fragments currently in use.
The FULL keyword is equivalent to specifying all
the keywords above and therefore all the network
activities are reported.
-o filename
Save the readings in the file in binary form. Each
reading is in a separate record. The default value
of the filename parameter is the current daily data
file, the /var/log/sa/sadd file. The -o option is
exclusive of the -f option.
-q Report queue length and load averages. The follow
ing values are displayed:
runq-sz
Run queue length (number of processes wait
ing for run time).
plist-sz
Number of processes in the process list.
ldavg-1
System load average for the last minute.
ldavg-5
System load average for the past 5 minutes.
-r Report memory and swap space utilization
kbmemfree
Amount of free memory available in kilo
bytes.
kbmemused
Amount of used memory in kilobytes. This
does not take into account memory used by
the kernel itself.
%memused
Percentage of used memory.
kbmemshrd
Amount of memory shared by the system in
kilobytes. Always zero with 2.4 kernels.
kbbuffers
Amount of memory used as buffers by the ker
nel in kilobytes.
kbcached
Amount of memory used to cache data by the
kernel in kilobytes.
kbswpfree
Amount of free swap space in kilobytes.
kbswpused
Amount of used swap space in kilobytes.
%swpused
Percentage of used swap space.
-R Report memory statistics. The following values are
displayed:
frmpg/s
Number of memory pages freed by the system
per second. A negative value represents a
number of pages allocated by the system.
Note that a page has a size of 4 KB or 8 KB
according to the machine architecture.
shmpg/s
Number of additionnal memory pages shared by
the system per second. A negative value
means fewer pages shared by the system.
bufpg/s
Number of additionnal memory pages used as
buffers by the system per second. A nega
tive value means fewer pages used as buffers
campg/s
Number of additionnal memory pages cached by
the system per second. A negative value
means fewer pages in the cache.
-s hh:mm:ss
Set the starting time of the data, causing the sar
command to extract records time-tagged at, or fol
lowing, the time specified. The default starting
time is 08:00. Hours must be given in 24-hour for
mat. This option can be used only when data are
read from a file (option -f ).
-t When reading data from a daily data file, indicate
that sar should display the timestamps in the orig
inal locale time of the data file creator. Without
this option, the sar command displays the times
tamps in the user locale time.
-u Report CPU utilization. The following values are
displayed:
%user
Percentage of CPU utilization that occurred
while executing at the user level (applica
tion).
%nice
Percentage of CPU utilization that occurred
while executing at the user level with nice
priority.
%system
Percentage of CPU utilization that occurred
while executing at the system level (ker
nel).
%idle
Percentage of time that the CPU or CPUs were
idle.
-U cpu | ALL
Report CPU utilization for a given processor. cpu
is the processor number. The ALL keyword indicates
that statistics are to be reported for all proces
sors. Note that processor 0 is the first processor.
-v Report status of inode, file and other kernel
tables. The following values are displayed:
dentunusd
Number of unused cache entries in the
file-sz
Number of used file handles.
%file-sz
Percentage of used file handles with regard
to the maximum number of file handles that
the Linux kernel can allocate.
inode-sz
Number of used inode handlers.
super-sz
Number of super block handlers allocated by
the kernel.
%super-sz
Percentage of allocated super block handlers
with regard to the maximum number of super
block handlers that Linux can allocate.
dquot-sz
Number of allocated disk quota entries.
%dquot-sz
Percentage of allocated disk quota entries
with regard to the maximum number of cached
disk quota entries that can be allocated.
rtsig-sz
Number of queued RT signals.
%rtsig-sz
Percentage of queued RT signals with regard
to the maximum number of RT signals that can
be queued.
-V Print version number and usage then exit.
-w Report system switching activity.
cswch/s
Total number of context switches per second.
-W Report swapping statistics. The following values
are displayed:
pswpin/s
Total number of swap pages the system
brought in per second.
pswpout/s
Total number of swap pages the system
-x pid | SELF | SUM | ALL
Report statistics for a given process. pid is the
process identification number. The SELF keyword
indicates that statistics are to be reported for
the sar process itself, whereas the ALL keyword
indicates that statistics are to be reported for
all the system processes. When the SUM keyword is
used, the total number of minor and major faults
made by the system is reported. All these statis
tics cannot be saved to a file. So this option
will be ignored whenever -o option is used. At the
present time, no more than 256 processes can be
monitored simultaneously.
When the SUM keyword is not used, the following
values are displayed:
minflt/s
Total number of minor faults the process has
made per second, those which have not
required loading a memory page from disk.
majflt/s
Total number of major faults the process has
made per second, those which have required
loading a memory page from disk.
%user
Percentage of CPU used by the process while
executing at the user level (application).
%system
Percentage of CPU used by the process while
executing at the system level (kernel).
nswap/s
Number of pages from the process address
space the system has swapped out per second.
CPU
Processor number to which the process is
attached.
When the SUM keyword is used on the command line,
the following values are displayed:
minflt/s
Total number of minor faults the system has
made per second, those which have not
required loading a memory page from disk.
majflt/s
made per second, those which have required
loading a memory page from disk.
These last two statistics are consistent only when
no processes have terminated. If a process is
killed during the interval, the statistics are not
available (marked as ????) and the average number
will not be computed.
-X pid | SELF | ALL
Report statistics for the child processes of the
process whose PID is pid . The SELF keyword indi
cates that statistics are to be reported for the
child processes of the sar process itself, whereas
the ALL keyword indicates that statistics are to be
reported for all the child processes of all the
system processes. All these statistics cannot be
saved to a file. So this option will be ignored
whenever -o option is used. At the present time,
no more than 256 processes can be monitored simul
taneously. The following values are displayed:
cminflt/s
Total number of minor faults the child pro
cesses have made per second, those which
have not required loading a memory page from
disk.
cmajflt/s
Total number of major faults the child pro
cesses have made per second, those which
have required loading a memory page from
disk.
%cuser
Percentage of CPU used by the child pro
cesses while executing at the user level
(application).
%csystem
Percentage of CPU used by the child pro
cesses while executing at the system level
(kernel).
cnswap/s
Number of pages from the child process
address spaces the system has swapped out
per second.
-y Report TTY device activity. The following values
are displayed:
rcvin/s
current serial line. Serial line number is
given in the TTY column.
xmtin/s
Number of transmit interrupts per second for
current serial line.
ENVIRONMENT
The sar command takes into account the following environ
ment variable:
S_TIME_FORMAT
If this variable exists and its value is ISO then
the current locale will be ignored when printing
the date in the report header. The sar command
will use the ISO format (YYYY-MM-DD) instead.
EXAMPLES
sar -u 2 5
Report CPU utilization for each 2 seconds. 5 lines
are displayed.
sar -I 14 -o int14.file 2 10
Report statistics on IRQ 14 for each 2 seconds. 10
lines are displayed. Data are stored in a file
called int14.file.
BUGS
/proc filesystem must be mounted for the sar command to
work.
All the statistics are not necessarily available, depend
ing on the kernel version used. In particular, TTY
statistics (option -y) are not available in 2.2.x SMP ker
nels (with x <= 15), because of an SMP race that sar may
trigger when reading the /proc/tty/driver/serial file.
FILES
/var/log/sa/sadd
Indicate the daily data file, where the dd parame
ter is a number representing the day of the month.
/proc contains various files with system statistics.
AUTHOR
Sebastien Godard <sebastien.godard@wanadoo.fr>
SEE ALSO
sadc(8), sa1(8), sa2(8), isag(1), mpstat(1), iostat(1),
vmstat(8)
Man(1) output converted with
man2html