1SAR(1) Linux User's Manual SAR(1)
2
6 sar - Collect, report, or save system activity information.
7
9 sar [ -A ] [ -b ] [ -B ] [ -C ] [ -d ] [ -h ] [ -i interval ] [ -m ] [
10 -p ] [ -q ] [ -r ] [ -R ] [ -S ] [ -t ] [ -u [ ALL ] ] [ -v ] [ -V ] [
11 -w ] [ -W ] [ -y ] [ -j { ID | LABEL | PATH | UUID | ... } ] [ -n {
12 keyword [,...] | ALL } ] [ -I { int [,...] | SUM | ALL | XALL } ] [ -P
13 { cpu [,...] | ALL } ] [ -o [ filename ] | -f [ filename ] ] [ --legacy
14 ] [ -s [ hh:mm:ss ] ] [ -e [ hh:mm:ss ] ] [ interval [ count ] ]
15
17 The sar command writes to standard output the contents of selected
18 cumulative activity counters in the operating system. The accounting
19 system, based on the values in the count and interval parameters,
20 writes information the specified number of times spaced at the speci‐
21 fied intervals in seconds. If the interval parameter is set to zero,
22 the sar command displays the average statistics for the time since the
23 system was started. If the interval parameter is specified without the
24 count parameter, then reports are generated continuously. The col‐
25 lected data can also be saved in the file specified by the -o filename
26 flag, in addition to being displayed onto the screen. If filename is
27 omitted, sar uses the standard system activity daily data file, the
28 /var/log/sa/sadd file, where the dd parameter indicates the current
29 day. By default all the data available from the kernel are saved in
30 the data file.
31 The sar command extracts and writes to standard output records previ‐
33 ously saved in a file. This file can be either the one specified by the
34 -f flag or, by default, the standard system activity daily data file.
35 Without the -P flag, the sar command reports system-wide (global among
37 all processors) statistics, which are calculated as averages for values
38 expressed as percentages, and as sums otherwise. If the -P flag is
39 given, the sar command reports activity which relates to the specified
40 processor or processors. If -P ALL is given, the sar command reports
41 statistics for each individual processor and global statistics among
42 all processors.
43 You can select information about specific system activities using
45 flags. Not specifying any flags selects only CPU activity. Specifying
46 the -A flag is equivalent to specifying -bBdqrRSvwWy -I SUM -I XALL -n
47 ALL -u ALL -P ALL.
48 The default version of the sar command (CPU utilization report) might
50 be one of the first facilities the user runs to begin system activity
51 investigation, because it monitors major system resources. If CPU uti‐
52 lization is near 100 percent (user + nice + system), the workload sam‐
53 pled is CPU-bound.
54 If multiple samples and multiple reports are desired, it is convenient
56 to specify an output file for the sar command. Run the sar command as
57 a background process. The syntax for this is:
58 sar -o datafile interval count >/dev/null 2>&1 &
60 All data is captured in binary form and saved to a file (datafile).
62 The data can then be selectively displayed with the sar command using
63 the -f option. Set the interval and count parameters to select count
64 records at interval second intervals. If the count parameter is not
65 set, all the records saved in the file will be selected. Collection of
66 data in this manner is useful to characterize system usage over a
67 period of time and determine peak usage hours.
68 Note: The sar command only reports on local activities.
70
73 -A This is equivalent to specifying -bBdqrRSuvwWy -I SUM -I XALL -n
74 ALL -u ALL -P ALL.
75 -b Report I/O and transfer rate statistics. The following values
77 are displayed:
78 tps
80 Total number of transfers per second that were issued to
81 physical devices. A transfer is an I/O request to a
82 physical device. Multiple logical requests can be com‐
83 bined into a single I/O request to the device. A trans‐
84 fer is of indeterminate size.
85 rtps
87 Total number of read requests per second issued to physi‐
88 cal devices.
89 wtps
91 Total number of write requests per second issued to phys‐
92 ical devices.
93 bread/s
95 Total amount of data read from the devices in blocks per
96 second. Blocks are equivalent to sectors with 2.4 ker‐
97 nels and newer and therefore have a size of 512 bytes.
98 With older kernels, a block is of indeterminate size.
99 bwrtn/s
101 Total amount of data written to devices in blocks per
102 second.
103 -B Report paging statistics. Some of the metrics below are avail‐
105 able only with post 2.5 kernels. The following values are dis‐
106 played:
107 pgpgin/s
109 Total number of kilobytes the system paged in from disk
110 per second. Note: With old kernels (2.2.x) this value is
111 a number of blocks per second (and not kilobytes).
112 pgpgout/s
114 Total number of kilobytes the system paged out to disk
115 per second. Note: With old kernels (2.2.x) this value is
116 a number of blocks per second (and not kilobytes).
117 fault/s
119 Number of page faults (major + minor) made by the system
120 per second. This is not a count of page faults that gen‐
121 erate I/O, because some page faults can be resolved with‐
122 out I/O.
123 majflt/s
125 Number of major faults the system has made per second,
126 those which have required loading a memory page from
127 disk.
128 pgfree/s
130 Number of pages placed on the free list by the system per
131 second.
132 pgscank/s
134 Number of pages scanned by the kswapd daemon per second.
135 pgscand/s
137 Number of pages scanned directly per second.
138 pgsteal/s
140 Number of pages the system has reclaimed from cache
141 (pagecache and swapcache) per second to satisfy its mem‐
142 ory demands.
143 %vmeff
145 Calculated as pgsteal / pgscan, this is a metric of the
146 efficiency of page reclaim. If it is near 100% then
147 almost every page coming off the tail of the inactive
148 list is being reaped. If it gets too low (e.g. less than
149 30%) then the virtual memory is having some difficulty.
150 This field is displayed as zero if no pages have been
151 scanned during the interval of time.
152 -C When reading data from a file, tell sar to display comments that
154 have been inserted by sadc.
155 -d Report activity for each block device (kernels 2.4 and newer
157 only). When data is displayed, the device specification dev m-n
158 is generally used ( DEV column). m is the major number of the
159 device. With recent kernels (post 2.5), n is the minor number
160 of the device, but is only a sequence number with pre 2.5 ker‐
161 nels. Device names may also be pretty-printed if option -p is
162 used or persistent device names can be printed if option -j is
163 used (see below). Values for fields avgqu-sz, await, svctm and
164 %util may be unavailable and displayed as 0.00 with some 2.4
165 kernels. Note that disk activity depends on sadc options "-S
166 DISK" and "-S XDISK" to be collected. The following values are
167 displayed:
168 tps
170 Indicate the number of transfers per second that were
171 issued to the device. Multiple logical requests can be
172 combined into a single I/O request to the device. A
173 transfer is of indeterminate size.
174 rd_sec/s
176 Number of sectors read from the device. The size of a
177 sector is 512 bytes.
178 wr_sec/s
180 Number of sectors written to the device. The size of a
181 sector is 512 bytes.
182 avgrq-sz
184 The average size (in sectors) of the requests that were
185 issued to the device.
186 avgqu-sz
188 The average queue length of the requests that were issued
189 to the device.
190 await
192 The average time (in milliseconds) for I/O requests
193 issued to the device to be served. This includes the time
194 spent by the requests in queue and the time spent servic‐
195 ing them.
196 svctm
198 The average service time (in milliseconds) for I/O
199 requests that were issued to the device.
200 %util
202 Percentage of elapsed time during which I/O requests were
203 issued to the device (bandwidth utilization for the
204 device). Device saturation occurs when this value is
205 close to 100%.
206 -e [ hh:mm:ss ]
208 Set the ending time of the report. The default ending time is
209 18:00:00. Hours must be given in 24-hour format. This option
210 can be used when data are read from or written to a file
211 (options -f or -o ).
212 -f [ filename ]
214 Extract records from filename (created by the -o filename flag).
215 The default value of the filename parameter is the current daily
216 data file, the /var/log/sa/sadd file. The -f option is exclusive
217 of the -o option.
218 -h Display a short help message then exit.
220 -i interval
222 Select data records at seconds as close as possible to the num‐
223 ber specified by the interval parameter.
224 -I { int [,...] | SUM | ALL | XALL }
226 Report statistics for a given interrupt. int is the interrupt
227 number. Specifying multiple -I int parameters on the command
228 line will look at multiple independent interrupts. The SUM key‐
229 word indicates that the total number of interrupts received per
230 second is to be displayed. The ALL keyword indicates that sta‐
231 tistics from the first 16 interrupts are to be reported, whereas
232 the XALL keyword indicates that statistics from all interrupts,
233 including potential APIC interrupt sources, are to be reported.
234 Note that interrupt statistics depend on sadc option "-S INT" to
235 be collected.
236 -j { ID | LABEL | PATH | UUID | ... }
238 Display persistent device names. Use this option in conjunction
239 with option -d. Options ID, LABEL, etc. specify the type of the
240 persistent name. These options are not limited, only prerequi‐
241 site is that directory with required persistent names is present
242 in /dev/disk. If persistent name is not found for the device,
243 the device name is pretty-printed (see option -p below).
244 --legacy
246 Enable reading older /var/log/sa/sadd data files. In Red Hat
247 Enterprise Linux 6.3, the sysstat package was updated to version
248 9.0.4-20. This update changed the format of /var/log/sa/sadd
249 data files, but unfortunately, the format version was not
250 updated. Because of this, sysstat did not restrict reading of
251 data files in old format and while interpreting them, some dis‐
252 played values could have been incorrect. The updated sysstat
253 package in Red Hat Enterprise Linux 6.5 contains fixed format
254 version of data files and prevents reading data files created by
255 older sysstat packages. However, data files created by the sys‐
256 stat packages from Red Hat Enterprise Linux 6.3 and 6.4 are
257 fully compatible with the sysstat package from Red Hat Enter‐
258 prise Linux 6.5. To enable latest sysstat to read older data
259 files, use this option. Note that this option allows you to read
260 also data files created on Red Hat Enterprise Linux 6.2 and ear‐
261 lier, however, these files are not compatible with the latest
262 sysstat package.
263 -m Report power management statistics. Note that these statistics
265 depend on sadc option "-S POWER" to be collected. The following
266 value is displayed:
267 MHz
269 CPU clock frequency in MHz.
270 -n { keyword [,...] | ALL }
272 Report network statistics.
273 Possible keywords are DEV, EDEV, NFS, NFSD, SOCK, IP, EIP, ICMP,
275 EICMP, TCP, ETCP, UDP, SOCK6, IP6, EIP6, ICMP6, EICMP6 and UDP6.
276 With the DEV keyword, statistics from the network devices are
278 reported. The following values are displayed:
279 IFACE
281 Name of the network interface for which statistics are
282 reported.
283 rxpck/s
285 Total number of packets received per second.
286 txpck/s
288 Total number of packets transmitted per second.
289 rxkB/s
291 Total number of kilobytes received per second.
292 txkB/s
294 Total number of kilobytes transmitted per second.
295 rxcmp/s
297 Number of compressed packets received per second (for
298 cslip etc.).
299 txcmp/s
301 Number of compressed packets transmitted per second.
302 rxmcst/s
304 Number of multicast packets received per second.
305 With the EDEV keyword, statistics on failures (errors) from the
307 network devices are reported. The following values are dis‐
308 played:
309 IFACE
311 Name of the network interface for which statistics are
312 reported.
313 rxerr/s
315 Total number of bad packets received per second.
316 txerr/s
318 Total number of errors that happened per second while
319 transmitting packets.
320 coll/s
322 Number of collisions that happened per second while
323 transmitting packets.
324 rxdrop/s
326 Number of received packets dropped per second because of
327 a lack of space in linux buffers.
328 txdrop/s
330 Number of transmitted packets dropped per second because
331 of a lack of space in linux buffers.
332 txcarr/s
334 Number of carrier-errors that happened per second while
335 transmitting packets.
336 rxfram/s
338 Number of frame alignment errors that happened per second
339 on received packets.
340 rxfifo/s
342 Number of FIFO overrun errors that happened per second on
343 received packets.
344 txfifo/s
346 Number of FIFO overrun errors that happened per second on
347 transmitted packets.
348 With the NFS keyword, statistics about NFS client activity are
350 reported. The following values are displayed:
351 call/s
353 Number of RPC requests made per second.
354 retrans/s
356 Number of RPC requests per second, those which needed to
357 be retransmitted (for example because of a server time‐
358 out).
359 read/s
361 Number of 'read' RPC calls made per second.
362 write/s
364 Number of 'write' RPC calls made per second.
365 access/s
367 Number of 'access' RPC calls made per second.
368 getatt/s
370 Number of 'getattr' RPC calls made per second.
371 With the NFSD keyword, statistics about NFS server activity are
373 reported. The following values are displayed:
374 scall/s
376 Number of RPC requests received per second.
377 badcall/s
379 Number of bad RPC requests received per second, those
380 whose processing generated an error.
381 packet/s
383 Number of network packets received per second.
384 udp/s
386 Number of UDP packets received per second.
387 tcp/s
389 Number of TCP packets received per second.
390 hit/s
392 Number of reply cache hits per second.
393 miss/s
395 Number of reply cache misses per second.
396 sread/s
398 Number of 'read' RPC calls received per second.
399 swrite/s
401 Number of 'write' RPC calls received per second.
402 saccess/s
404 Number of 'access' RPC calls received per second.
405 sgetatt/s
407 Number of 'getattr' RPC calls received per second.
408 With the SOCK keyword, statistics on sockets in use are reported
410 (IPv4). The following values are displayed:
411 totsck
413 Total number of sockets used by the system.
414 tcpsck
416 Number of TCP sockets currently in use.
417 udpsck
419 Number of UDP sockets currently in use.
420 rawsck
422 Number of RAW sockets currently in use.
423 ip-frag
425 Number of IP fragments currently in use.
426 tcp-tw
428 Number of TCP sockets in TIME_WAIT state.
429 With the IP keyword, statistics about IPv4 network traffic are
431 reported. Note that IPv4 statistics depend on sadc option "-S
432 SNMP" to be collected. The following values are displayed (for‐
433 mal SNMP names between square brackets):
434 irec/s
436 The total number of input datagrams received from inter‐
437 faces per second, including those received in error
438 [ipInReceives].
439 fwddgm/s
441 The number of input datagrams per second, for which this
442 entity was not their final IP destination, as a result of
443 which an attempt was made to find a route to forward them
444 to that final destination [ipForwDatagrams].
445 idel/s
447 The total number of input datagrams successfully deliv‐
448 ered per second to IP user-protocols (including ICMP)
449 [ipInDelivers].
450 orq/s
452 The total number of IP datagrams which local IP user-pro‐
453 tocols (including ICMP) supplied per second to IP in
454 requests for transmission [ipOutRequests]. Note that
455 this counter does not include any datagrams counted in
456 fwddgm/s.
457 asmrq/s
459 The number of IP fragments received per second which
460 needed to be reassembled at this entity [ipReasmReqds].
461 asmok/s
463 The number of IP datagrams successfully re-assembled per
464 second [ipReasmOKs].
465 fragok/s
467 The number of IP datagrams that have been successfully
468 fragmented at this entity per second [ipFragOKs].
469 fragcrt/s
471 The number of IP datagram fragments that have been gener‐
472 ated per second as a result of fragmentation at this
473 entity [ipFragCreates].
474 With the EIP keyword, statistics about IPv4 network errors are
476 reported. Note that IPv4 statistics depend on sadc option "-S
477 SNMP" to be collected. The following values are displayed (for‐
478 mal SNMP names between square brackets):
479 ihdrerr/s
481 The number of input datagrams discarded per second due to
482 errors in their IP headers, including bad checksums, ver‐
483 sion number mismatch, other format errors, time-to-live
484 exceeded, errors discovered in processing their IP
485 options, etc. [ipInHdrErrors]
486 iadrerr/s
488 The number of input datagrams discarded per second
489 because the IP address in their IP header's destination
490 field was not a valid address to be received at this
491 entity. This count includes invalid addresses (e.g.,
492 0.0.0.0) and addresses of unsupported Classes (e.g.,
493 Class E). For entities which are not IP routers and
494 therefore do not forward datagrams, this counter includes
495 datagrams discarded because the destination address was
496 not a local address [ipInAddrErrors].
497 iukwnpr/s
499 The number of locally-addressed datagrams received suc‐
500 cessfully but discarded per second because of an unknown
501 or unsupported protocol [ipInUnknownProtos].
502 idisc/s
504 The number of input IP datagrams per second for which no
505 problems were encountered to prevent their continued pro‐
506 cessing, but which were discarded (e.g., for lack of buf‐
507 fer space) [ipInDiscards]. Note that this counter does
508 not include any datagrams discarded while awaiting re-
509 assembly.
510 odisc/s
512 The number of output IP datagrams per second for which no
513 problem was encountered to prevent their transmission to
514 their destination, but which were discarded (e.g., for
515 lack of buffer space) [ipOutDiscards]. Note that this
516 counter would include datagrams counted in fwddgm/s if
517 any such packets met this (discretionary) discard crite‐
518 rion.
519 onort/s
521 The number of IP datagrams discarded per second because
522 no route could be found to transmit them to their desti‐
523 nation [ipOutNoRoutes]. Note that this counter includes
524 any packets counted in fwddgm/s which meet this 'no-
525 route' criterion. Note that this includes any datagrams
526 which a host cannot route because all of its default
527 routers are down.
528 asmf/s
530 The number of failures detected per second by the IP re-
531 assembly algorithm (for whatever reason: timed out,
532 errors, etc) [ipReasmFails]. Note that this is not nec‐
533 essarily a count of discarded IP fragments since some
534 algorithms can lose track of the number of fragments by
535 combining them as they are received.
536 fragf/s
538 The number of IP datagrams that have been discarded per
539 second because they needed to be fragmented at this
540 entity but could not be, e.g., because their Don't Frag‐
541 ment flag was set [ipFragFails].
542 With the ICMP keyword, statistics about ICMPv4 network traffic
544 are reported. Note that ICMPv4 statistics depend on sadc option
545 "-S SNMP" to be collected. The following values are displayed
546 (formal SNMP names between square brackets):
547 imsg/s
549 The total number of ICMP messages which the entity
550 received per second [icmpInMsgs]. Note that this counter
551 includes all those counted by ierr/s.
552 omsg/s
554 The total number of ICMP messages which this entity
555 attempted to send per second [icmpOutMsgs]. Note that
556 this counter includes all those counted by oerr/s.
557 iech/s
559 The number of ICMP Echo (request) messages received per
560 second [icmpInEchos].
561 iechr/s
563 The number of ICMP Echo Reply messages received per sec‐
564 ond [icmpInEchoReps].
565 oech/s
567 The number of ICMP Echo (request) messages sent per sec‐
568 ond [icmpOutEchos].
569 oechr/s
571 The number of ICMP Echo Reply messages sent per second
572 [icmpOutEchoReps].
573 itm/s
575 The number of ICMP Timestamp (request) messages received
576 per second [icmpInTimestamps].
577 itmr/s
579 The number of ICMP Timestamp Reply messages received per
580 second [icmpInTimestampReps].
581 otm/s
583 The number of ICMP Timestamp (request) messages sent per
584 second [icmpOutTimestamps].
585 otmr/s
587 The number of ICMP Timestamp Reply messages sent per sec‐
588 ond [icmpOutTimestampReps].
589 iadrmk/s
591 The number of ICMP Address Mask Request messages received
592 per second [icmpInAddrMasks].
593 iadrmkr/s
595 The number of ICMP Address Mask Reply messages received
596 per second [icmpInAddrMaskReps].
597 oadrmk/s
599 The number of ICMP Address Mask Request messages sent per
600 second [icmpOutAddrMasks].
601 oadrmkr/s
603 The number of ICMP Address Mask Reply messages sent per
604 second [icmpOutAddrMaskReps].
605 With the EICMP keyword, statistics about ICMPv4 error messages
607 are reported. Note that ICMPv4 statistics depend on sadc option
608 "-S SNMP" to be collected. The following values are displayed
609 (formal SNMP names between square brackets):
610 ierr/s
612 The number of ICMP messages per second which the entity
613 received but determined as having ICMP-specific errors
614 (bad ICMP checksums, bad length, etc.) [icmpInErrors].
615 oerr/s
617 The number of ICMP messages per second which this entity
618 did not send due to problems discovered within ICMP such
619 as a lack of buffers [icmpOutErrors].
620 idstunr/s
622 The number of ICMP Destination Unreachable messages
623 received per second [icmpInDestUnreachs].
624 odstunr/s
626 The number of ICMP Destination Unreachable messages sent
627 per second [icmpOutDestUnreachs].
628 itmex/s
630 The number of ICMP Time Exceeded messages received per
631 second [icmpInTimeExcds].
632 otmex/s
634 The number of ICMP Time Exceeded messages sent per second
635 [icmpOutTimeExcds].
636 iparmpb/s
638 The number of ICMP Parameter Problem messages received
639 per second [icmpInParmProbs].
640 oparmpb/s
642 The number of ICMP Parameter Problem messages sent per
643 second [icmpOutParmProbs].
644 isrcq/s
646 The number of ICMP Source Quench messages received per
647 second [icmpInSrcQuenchs].
648 osrcq/s
650 The number of ICMP Source Quench messages sent per second
651 [icmpOutSrcQuenchs].
652 iredir/s
654 The number of ICMP Redirect messages received per second
655 [icmpInRedirects].
656 oredir/s
658 The number of ICMP Redirect messages sent per second
659 [icmpOutRedirects].
660 With the TCP keyword, statistics about TCPv4 network traffic are
662 reported. Note that TCPv4 statistics depend on sadc option "-S
663 SNMP" to be collected. The following values are displayed (for‐
664 mal SNMP names between square brackets):
665 active/s
667 The number of times TCP connections have made a direct
668 transition to the SYN-SENT state from the CLOSED state
669 per second [tcpActiveOpens].
670 passive/s
672 The number of times TCP connections have made a direct
673 transition to the SYN-RCVD state from the LISTEN state
674 per second [tcpPassiveOpens].
675 iseg/s
677 The total number of segments received per second, includ‐
678 ing those received in error [tcpInSegs]. This count
679 includes segments received on currently established con‐
680 nections.
681 oseg/s
683 The total number of segments sent per second, including
684 those on current connections but excluding those contain‐
685 ing only retransmitted octets [tcpOutSegs].
686 With the ETCP keyword, statistics about TCPv4 network errors are
688 reported. Note that TCPv4 statistics depend on sadc option "-S
689 SNMP" to be collected. The following values are displayed (for‐
690 mal SNMP names between square brackets):
691 atmptf/s
693 The number of times per second TCP connections have made
694 a direct transition to the CLOSED state from either the
695 SYN-SENT state or the SYN-RCVD state, plus the number of
696 times per second TCP connections have made a direct tran‐
697 sition to the LISTEN state from the SYN-RCVD state
698 [tcpAttemptFails].
699 estres/s
701 The number of times per second TCP connections have made
702 a direct transition to the CLOSED state from either the
703 ESTABLISHED state or the CLOSE-WAIT state [tcpEstabRe‐
704 sets].
705 retrans/s
707 The total number of segments retransmitted per second -
708 that is, the number of TCP segments transmitted contain‐
709 ing one or more previously transmitted octets [tcpRe‐
710 transSegs].
711 isegerr/s
713 The total number of segments received in error (e.g., bad
714 TCP checksums) per second [tcpInErrs].
715 orsts/s
717 The number of TCP segments sent per second containing the
718 RST flag [tcpOutRsts].
719 With the UDP keyword, statistics about UDPv4 network traffic are
721 reported. Note that UDPv4 statistics depend on sadc option "-S
722 SNMP" to be collected. The following values are displayed (for‐
723 mal SNMP names between square brackets):
724 idgm/s
726 The total number of UDP datagrams delivered per second to
727 UDP users [udpInDatagrams].
728 odgm/s
730 The total number of UDP datagrams sent per second from
731 this entity [udpOutDatagrams].
732 noport/s
734 The total number of received UDP datagrams per second for
735 which there was no application at the destination port
736 [udpNoPorts].
737 idgmerr/s
739 The number of received UDP datagrams per second that
740 could not be delivered for reasons other than the lack of
741 an application at the destination port [udpInErrors].
742 With the SOCK6 keyword, statistics on sockets in use are
744 reported (IPv6). Note that IPv6 statistics depend on sadc
745 option "-S IPV6" to be collected. The following values are dis‐
746 played:
747 tcp6sck
749 Number of TCPv6 sockets currently in use.
750 udp6sck
752 Number of UDPv6 sockets currently in use.
753 raw6sck
755 Number of RAWv6 sockets currently in use.
756 ip6-frag
758 Number of IPv6 fragments currently in use.
759 With the IP6 keyword, statistics about IPv6 network traffic are
761 reported. Note that IPv6 statistics depend on sadc option "-S
762 IPV6" to be collected. The following values are displayed (for‐
763 mal SNMP names between square brackets):
764 irec6/s
766 The total number of input datagrams received from inter‐
767 faces per second, including those received in error
768 [ipv6IfStatsInReceives].
769 fwddgm6/s
771 The number of output datagrams per second which this
772 entity received and forwarded to their final destinations
773 [ipv6IfStatsOutForwDatagrams].
774 idel6/s
776 The total number of datagrams successfully delivered per
777 second to IPv6 user-protocols (including ICMP) [ipv6IfS‐
778 tatsInDelivers].
779 orq6/s
781 The total number of IPv6 datagrams which local IPv6 user-
782 protocols (including ICMP) supplied per second to IPv6 in
783 requests for transmission [ipv6IfStatsOutRequests]. Note
784 that this counter does not include any datagrams counted
785 in fwddgm6/s.
786 asmrq6/s
788 The number of IPv6 fragments received per second which
789 needed to be reassembled at this interface [ipv6IfStat‐
790 sReasmReqds].
791 asmok6/s
793 The number of IPv6 datagrams successfully reassembled per
794 second [ipv6IfStatsReasmOKs].
795 imcpck6/s
797 The number of multicast packets received per second by
798 the interface [ipv6IfStatsInMcastPkts].
799 omcpck6/s
801 The number of multicast packets transmitted per second by
802 the interface [ipv6IfStatsOutMcastPkts].
803 fragok6/s
805 The number of IPv6 datagrams that have been successfully
806 fragmented at this output interface per second [ipv6IfS‐
807 tatsOutFragOKs].
808 fragcr6/s
810 The number of output datagram fragments that have been
811 generated per second as a result of fragmentation at this
812 output interface [ipv6IfStatsOutFragCreates].
813 With the EIP6 keyword, statistics about IPv6 network errors are
815 reported. Note that IPv6 statistics depend on sadc option "-S
816 IPV6" to be collected. The following values are displayed (for‐
817 mal SNMP names between square brackets):
818 ihdrer6/s
820 The number of input datagrams discarded per second due to
821 errors in their IPv6 headers, including version number
822 mismatch, other format errors, hop count exceeded, errors
823 discovered in processing their IPv6 options, etc.
824 [ipv6IfStatsInHdrErrors]
825 iadrer6/s
827 The number of input datagrams discarded per second
828 because the IPv6 address in their IPv6 header's destina‐
829 tion field was not a valid address to be received at this
830 entity. This count includes invalid addresses (e.g., ::0)
831 and unsupported addresses (e.g., addresses with unallo‐
832 cated prefixes). For entities which are not IPv6 routers
833 and therefore do not forward datagrams, this counter
834 includes datagrams discarded because the destination
835 address was not a local address [ipv6IfStatsInAddr‐
836 Errors].
837 iukwnp6/s
839 The number of locally-addressed datagrams received suc‐
840 cessfully but discarded per second because of an unknown
841 or unsupported protocol [ipv6IfStatsInUnknownProtos].
842 i2big6/s
844 The number of input datagrams that could not be forwarded
845 per second because their size exceeded the link MTU of
846 outgoing interface [ipv6IfStatsInTooBigErrors].
847 idisc6/s
849 The number of input IPv6 datagrams per second for which
850 no problems were encountered to prevent their continued
851 processing, but which were discarded (e.g., for lack of
852 buffer space) [ipv6IfStatsInDiscards]. Note that this
853 counter does not include any datagrams discarded while
854 awaiting re-assembly.
855 odisc6/s
857 The number of output IPv6 datagrams per second for which
858 no problem was encountered to prevent their transmission
859 to their destination, but which were discarded (e.g., for
860 lack of buffer space) [ipv6IfStatsOutDiscards]. Note that
861 this counter would include datagrams counted in fwddgm6/s
862 if any such packets met this (discretionary) discard cri‐
863 terion.
864 inort6/s
866 The number of input datagrams discarded per second
867 because no route could be found to transmit them to their
868 destination [ipv6IfStatsInNoRoutes].
869 onort6/s
871 The number of locally generated IP datagrams discarded
872 per second because no route could be found to transmit
873 them to their destination [unknown formal SNMP name].
874 asmf6/s
876 The number of failures detected per second by the IPv6
877 re-assembly algorithm (for whatever reason: timed out,
878 errors, etc.) [ipv6IfStatsReasmFails]. Note that this is
879 not necessarily a count of discarded IPv6 fragments since
880 some algorithms can lose track of the number of fragments
881 by combining them as they are received.
882 fragf6/s
884 The number of IPv6 datagrams that have been discarded per
885 second because they needed to be fragmented at this out‐
886 put interface but could not be [ipv6IfStatsOutFragFails].
887 itrpck6/s
889 The number of input datagrams discarded per second
890 because datagram frame didn't carry enough data [ipv6IfS‐
891 tatsInTruncatedPkts].
892 With the ICMP6 keyword, statistics about ICMPv6 network traffic
894 are reported. Note that ICMPv6 statistics depend on sadc option
895 "-S IPV6" to be collected. The following values are displayed
896 (formal SNMP names between square brackets):
897 imsg6/s
899 The total number of ICMP messages received by the inter‐
900 face per second which includes all those counted by
901 ierr6/s [ipv6IfIcmpInMsgs].
902 omsg6/s
904 The total number of ICMP messages which this interface
905 attempted to send per second [ipv6IfIcmpOutMsgs].
906 iech6/s
908 The number of ICMP Echo (request) messages received by
909 the interface per second [ipv6IfIcmpInEchos].
910 iechr6/s
912 The number of ICMP Echo Reply messages received by the
913 interface per second [ipv6IfIcmpInEchoReplies].
914 oechr6/s
916 The number of ICMP Echo Reply messages sent by the inter‐
917 face per second [ipv6IfIcmpOutEchoReplies].
918 igmbq6/s
920 The number of ICMPv6 Group Membership Query messages
921 received by the interface per second [ipv6IfIcmpInGroup‐
922 MembQueries].
923 igmbr6/s
925 The number of ICMPv6 Group Membership Response messages
926 received by the interface per second [ipv6IfIcmpInGroup‐
927 MembResponses].
928 ogmbr6/s
930 The number of ICMPv6 Group Membership Response messages
931 sent per second [ipv6IfIcmpOutGroupMembResponses].
932 igmbrd6/s
934 The number of ICMPv6 Group Membership Reduction messages
935 received by the interface per second [ipv6IfIcmpInGroup‐
936 MembReductions].
937 ogmbrd6/s
939 The number of ICMPv6 Group Membership Reduction messages
940 sent per second [ipv6IfIcmpOutGroupMembReductions].
941 irtsol6/s
943 The number of ICMP Router Solicit messages received by
944 the interface per second [ipv6IfIcmpInRouterSolicits].
945 ortsol6/s
947 The number of ICMP Router Solicitation messages sent by
948 the interface per second [ipv6IfIcmpOutRouterSolicits].
949 irtad6/s
951 The number of ICMP Router Advertisement messages received
952 by the interface per second [ipv6IfIcmpInRouterAdvertise‐
953 ments].
954 inbsol6/s
956 The number of ICMP Neighbor Solicit messages received by
957 the interface per second [ipv6IfIcmpInNeighborSolicits].
958 onbsol6/s
960 The number of ICMP Neighbor Solicitation messages sent by
961 the interface per second [ipv6IfIcmpOutNeighborSolicits].
962 inbad6/s
964 The number of ICMP Neighbor Advertisement messages
965 received by the interface per second [ipv6IfIcmpInNeighb‐
966 orAdvertisements].
967 onbad6/s
969 The number of ICMP Neighbor Advertisement messages sent
970 by the interface per second [ipv6IfIcmpOutNeighborAdver‐
971 tisements].
972 With the EICMP6 keyword, statistics about ICMPv6 error messages
974 are reported. Note that ICMPv6 statistics depend on sadc option
975 "-S IPV6" to be collected. The following values are displayed
976 (formal SNMP names between square brackets):
977 ierr6/s
979 The number of ICMP messages per second which the inter‐
980 face received but determined as having ICMP-specific
981 errors (bad ICMP checksums, bad length, etc.)
982 [ipv6IfIcmpInErrors]
983 idtunr6/s
985 The number of ICMP Destination Unreachable messages
986 received by the interface per second [ipv6IfIcmpInDestUn‐
987 reachs].
988 odtunr6/s
990 The number of ICMP Destination Unreachable messages sent
991 by the interface per second [ipv6IfIcmpOutDestUnreachs].
992 itmex6/s
994 The number of ICMP Time Exceeded messages received by the
995 interface per second [ipv6IfIcmpInTimeExcds].
996 otmex6/s
998 The number of ICMP Time Exceeded messages sent by the
999 interface per second [ipv6IfIcmpOutTimeExcds].
1000 iprmpb6/s
1002 The number of ICMP Parameter Problem messages received by
1003 the interface per second [ipv6IfIcmpInParmProblems].
1004 oprmpb6/s
1006 The number of ICMP Parameter Problem messages sent by the
1007 interface per second [ipv6IfIcmpOutParmProblems].
1008 iredir6/s
1010 The number of Redirect messages received by the interface
1011 per second [ipv6IfIcmpInRedirects].
1012 oredir6/s
1014 The number of Redirect messages sent by the interface by
1015 second [ipv6IfIcmpOutRedirects].
1016 ipck2b6/s
1018 The number of ICMP Packet Too Big messages received by
1019 the interface per second [ipv6IfIcmpInPktTooBigs].
1020 opck2b6/s
1022 The number of ICMP Packet Too Big messages sent by the
1023 interface per second [ipv6IfIcmpOutPktTooBigs].
1024 With the UDP6 keyword, statistics about UDPv6 network traffic
1026 are reported. Note that UDPv6 statistics depend on sadc option
1027 "-S IPV6" to be collected. The following values are displayed
1028 (formal SNMP names between square brackets):
1029 idgm6/s
1031 The total number of UDP datagrams delivered per second to
1032 UDP users [udpInDatagrams].
1033 odgm6/s
1035 The total number of UDP datagrams sent per second from
1036 this entity [udpOutDatagrams].
1037 noport6/s
1039 The total number of received UDP datagrams per second for
1040 which there was no application at the destination port
1041 [udpNoPorts].
1042 idgmer6/s
1044 The number of received UDP datagrams per second that
1045 could not be delivered for reasons other than the lack of
1046 an application at the destination port [udpInErrors].
1047 The ALL keyword is equivalent to specifying all the keywords
1049 above and therefore all the network activities are reported.
1050 -o [ filename ]
1052 Save the readings in the file in binary form. Each reading is in
1053 a separate record. The default value of the filename parameter
1054 is the current daily data file, the /var/log/sa/sadd file. The
1055 -o option is exclusive of the -f option. All the data available
1056 from the kernel are saved in the file (in fact, sar calls its
1057 data collector sadc with the option "-S ALL". See sadc(8) manual
1058 page).
1059 -P { cpu [,...] | ALL }
1061 Report per-processor statistics for the specified processor or
1062 processors. Specifying the ALL keyword reports statistics for
1063 each individual processor, and globally for all processors.
1064 Note that processor 0 is the first processor.
1065 -p Pretty-print device names. Use this option in conjunction with
1067 option -d. By default names are printed as dev m-n where m and
1068 n are the major and minor numbers for the device. Use of this
1069 option displays the names of the devices as they (should) appear
1070 in /dev. Name mappings are controlled by /etc/sysconfig/sys‐
1071 stat.ioconf.
1072 -q Report queue length and load averages. The following values are
1074 displayed:
1075 runq-sz
1077 Run queue length (number of tasks waiting for run time).
1078 plist-sz
1080 Number of tasks in the task list.
1081 ldavg-1
1083 System load average for the last minute. The load aver‐
1084 age is calculated as the average number of runnable or
1085 running tasks (R state), and the number of tasks in unin‐
1086 terruptible sleep (D state) over the specified interval.
1087 ldavg-5
1089 System load average for the past 5 minutes.
1090 ldavg-15
1092 System load average for the past 15 minutes.
1093 -r Report memory utilization statistics. The following values are
1095 displayed:
1096 kbmemfree
1098 Amount of free memory available in kilobytes.
1099 kbmemused
1101 Amount of used memory in kilobytes. This does not take
1102 into account memory used by the kernel itself.
1103 %memused
1105 Percentage of used memory.
1106 kbbuffers
1108 Amount of memory used as buffers by the kernel in kilo‐
1109 bytes.
1110 kbcached
1112 Amount of memory used to cache data by the kernel in
1113 kilobytes.
1114 kbcommit
1116 Amount of memory in kilobytes needed for current work‐
1117 load. This is an estimate of how much RAM/swap is needed
1118 to guarantee that there never is out of memory.
1119 %commit
1121 Percentage of memory needed for current workload in rela‐
1122 tion to the total amount of memory (RAM+swap). This num‐
1123 ber may be greater than 100% because the kernel usually
1124 overcommits memory.
1125 -R Report memory statistics. The following values are displayed:
1128 frmpg/s
1130 Number of memory pages freed by the system per second. A
1131 negative value represents a number of pages allocated by
1132 the system. Note that a page has a size of 4 kB or 8 kB
1133 according to the machine architecture.
1134 bufpg/s
1136 Number of additional memory pages used as buffers by the
1137 system per second. A negative value means fewer pages
1138 used as buffers by the system.
1139 campg/s
1141 Number of additional memory pages cached by the system
1142 per second. A negative value means fewer pages in the
1143 cache.
1144 -s [ hh:mm:ss ]
1146 Set the starting time of the data, causing the sar command to
1147 extract records time-tagged at, or following, the time speci‐
1148 fied. The default starting time is 08:00:00. Hours must be
1149 given in 24-hour format. This option can be used only when data
1150 are read from a file (option -f ).
1151 -S Report swap space utilization statistics. The following values
1153 are displayed:
1154 kbswpfree
1156 Amount of free swap space in kilobytes.
1157 kbswpused
1159 Amount of used swap space in kilobytes.
1160 %swpused
1162 Percentage of used swap space.
1163 kbswpcad
1165 Amount of cached swap memory in kilobytes. This is mem‐
1166 ory that once was swapped out, is swapped back in but
1167 still also is in the swap area (if memory is needed it
1168 doesn't need to be swapped out again because it is
1169 already in the swap area. This saves I/O).
1170 %swpcad
1172 Percentage of cached swap memory in relation to the
1173 amount of used swap space.
1174 -t When reading data from a daily data file, indicate that sar
1176 should display the timestamps in the original locale time of the
1177 data file creator. Without this option, the sar command displays
1178 the timestamps in the user's locale time.
1179 -u [ ALL ]
1181 Report CPU utilization. The ALL keyword indicates that all the
1182 CPU fields should be displayed. The report may show the follow‐
1183 ing fields:
1184 %user
1186 Percentage of CPU utilization that occurred while execut‐
1187 ing at the user level (application). Note that this field
1188 includes time spent running virtual processors.
1189 %usr
1191 Percentage of CPU utilization that occurred while execut‐
1192 ing at the user level (application). Note that this field
1193 does NOT include time spent running virtual processors.
1194 %nice
1196 Percentage of CPU utilization that occurred while execut‐
1197 ing at the user level with nice priority.
1198 %system
1200 Percentage of CPU utilization that occurred while execut‐
1201 ing at the system level (kernel). Note that this field
1202 includes time spent servicing hardware and software
1203 interrupts.
1204 %sys
1206 Percentage of CPU utilization that occurred while execut‐
1207 ing at the system level (kernel). Note that this field
1208 does NOT include time spent servicing hardware or soft‐
1209 ware interrupts.
1210 %iowait
1212 Percentage of time that the CPU or CPUs were idle during
1213 which the system had an outstanding disk I/O request.
1214 %steal
1216 Percentage of time spent in involuntary wait by the vir‐
1217 tual CPU or CPUs while the hypervisor was servicing
1218 another virtual processor.
1219 %irq
1221 Percentage of time spent by the CPU or CPUs to service
1222 hardware interrupts.
1223 %soft
1225 Percentage of time spent by the CPU or CPUs to service
1226 software interrupts.
1227 %guest
1229 Percentage of time spent by the CPU or CPUs to run a vir‐
1230 tual processor.
1231 %idle
1233 Percentage of time that the CPU or CPUs were idle and the
1234 system did not have an outstanding disk I/O request.
1235 Note: On SMP machines a processor that does not have any activ‐
1237 ity at all (0.00 for every field) is a disabled (offline) pro‐
1238 cessor.
1239 -v Report status of inode, file and other kernel tables. The fol‐
1241 lowing values are displayed:
1242 dentunusd
1244 Number of unused cache entries in the directory cache.
1245 file-nr
1247 Number of file handles used by the system.
1248 inode-nr
1250 Number of inode handlers used by the system.
1251 pty-nr
1253 Number of pseudo-terminals used by the system.
1254 -V Print version number then exit.
1256 -w Report task creation and system switching activity.
1258 proc/s
1260 Total number of tasks created per second.
1261 cswch/s
1263 Total number of context switches per second.
1264 -W Report swapping statistics. The following values are displayed:
1266 pswpin/s
1268 Total number of swap pages the system brought in per sec‐
1269 ond.
1270 pswpout/s
1272 Total number of swap pages the system brought out per
1273 second.
1274 -y Report TTY device activity. The following values are displayed:
1276 rcvin/s
1278 Number of receive interrupts per second for current
1279 serial line. Serial line number is given in the TTY col‐
1280 umn.
1281 xmtin/s
1283 Number of transmit interrupts per second for current
1284 serial line.
1285 framerr/s
1287 Number of frame errors per second for current serial
1288 line.
1289 prtyerr/s
1291 Number of parity errors per second for current serial
1292 line.
1293 brk/s
1295 Number of breaks per second for current serial line.
1296 ovrun/s
1298 Number of overrun errors per second for current serial
1299 line.
1300 Note that with recent 2.6 kernels, these statistics can be
1302 retrieved only by root.
1303
1306 The sar command takes into account the following environment variables:
1307 S_TIME_FORMAT
1310 If this variable exists and its value is ISO then the current
1311 locale will be ignored when printing the date in the report
1312 header. The sar command will use the ISO 8601 format (YYYY-MM-
1313 DD) instead.
1314 S_TIME_DEF_TIME
1317 If this variable exists and its value is UTC then sar will save
1318 its data in UTC time (data will still be displayed in local
1319 time). sar will also use UTC time instead of local time to
1320 determine the current daily data file located in the /var/log/sa
1321 directory. This variable may be useful for servers with users
1322 located across several timezones.
1323
1325 sar -u 2 5
1326 Report CPU utilization for each 2 seconds. 5 lines are dis‐
1327 played.
1328 sar -I 14 -o int14.file 2 10
1330 Report statistics on IRQ 14 for each 2 seconds. 10 lines are
1331 displayed. Data are stored in a file called int14.file.
1332 sar -r -n DEV -f /var/log/sa/sa16
1334 Display memory and network statistics saved in daily data file
1335 'sa16'.
1336 sar -A
1338 Display all the statistics saved in current daily data file.
1339
1341 /proc filesystem must be mounted for the sar command to work.
1342 All the statistics are not necessarily available, depending on the ker‐
1344 nel version used.
1345
1347 /var/log/sa/sadd
1348 Indicate the daily data file, where the dd parameter is a number
1349 representing the day of the month.
1350 /proc contains various files with system statistics.
1352
1354 Sebastien Godard (sysstat <at> orange.fr)
1355
1357 sadc(8), sa1(8), sa2(8), sadf(1), isag(1), pidstat(1), mpstat(1),
1358 iostat(1), vmstat(8)
1359 http://pagesperso-orange.fr/sebastien.godard/
1361Linux MAY 2009 SAR(1)