1SAR(1) Linux User's Manual SAR(1)
2
6 sar - Collect, report, or save system activity information.
7
9 sar [ -A ] [ -B ] [ -b ] [ -C ] [ -d ] [ -F ] [ -H ] [ -h ] [ -p ] [ -q
10 ] [ -R ] [ -r ] [ -S ] [ -t ] [ -u [ ALL ] ] [ -V ] [ -v ] [ -W ] [ -w
11 ] [ -y ] [ -I { int [,...] | SUM | ALL | XALL } ] [ -P { cpu [,...] |
12 ALL } ] [ -m { keyword [,...] | ALL } ] [ -n { keyword [,...] | ALL } ]
13 [ -j { ID | LABEL | PATH | UUID | ... } ] [ -f [ filename ] | -o [
14 filename ] | -[0-9]+ ] [ -i interval ] [ -s [ hh:mm:ss ] ] [ -e [
15 hh:mm:ss ] ] [ interval [ count ] ]
16
18 The sar command writes to standard output the contents of selected
19 cumulative activity counters in the operating system. The accounting
20 system, based on the values in the count and interval parameters,
21 writes information the specified number of times spaced at the speci‐
22 fied intervals in seconds. If the interval parameter is set to zero,
23 the sar command displays the average statistics for the time since the
24 system was started. If the interval parameter is specified without the
25 count parameter, then reports are generated continuously. The col‐
26 lected data can also be saved in the file specified by the -o filename
27 flag, in addition to being displayed onto the screen. If filename is
28 omitted, sar uses the standard system activity daily data file, the
29 /var/log/sa/sadd file, where the dd parameter indicates the current
30 day. By default all the data available from the kernel are saved in
31 the data file.
32 The sar command extracts and writes to standard output records previ‐
34 ously saved in a file. This file can be either the one specified by the
35 -f flag or, by default, the standard system activity daily data file.
36 It is also possible to enter -1, -2 etc. as an argument to sar to dis‐
37 play data of that days ago. For example, -1 will point at the standard
38 system activity file of yesterday.
39 Without the -P flag, the sar command reports system-wide (global among
41 all processors) statistics, which are calculated as averages for values
42 expressed as percentages, and as sums otherwise. If the -P flag is
43 given, the sar command reports activity which relates to the specified
44 processor or processors. If -P ALL is given, the sar command reports
45 statistics for each individual processor and global statistics among
46 all processors.
47 You can select information about specific system activities using
49 flags. Not specifying any flags selects only CPU activity. Specifying
50 the -A flag selects all possible activities.
51 The default version of the sar command (CPU utilization report) might
53 be one of the first facilities the user runs to begin system activity
54 investigation, because it monitors major system resources. If CPU uti‐
55 lization is near 100 percent (user + nice + system), the workload sam‐
56 pled is CPU-bound.
57 If multiple samples and multiple reports are desired, it is convenient
59 to specify an output file for the sar command. Run the sar command as
60 a background process. The syntax for this is:
61 sar -o datafile interval count >/dev/null 2>&1 &
63 All data are captured in binary form and saved to a file (datafile).
65 The data can then be selectively displayed with the sar command using
66 the -f option. Set the interval and count parameters to select count
67 records at interval second intervals. If the count parameter is not
68 set, all the records saved in the file will be selected. Collection of
69 data in this manner is useful to characterize system usage over a
70 period of time and determine peak usage hours.
71 Note: The sar command only reports on local activities.
73
76 -A This is equivalent to specifying -bBdFHqrRSuvwWy -I SUM -I XALL
77 -m ALL -n ALL -u ALL -P ALL.
78 -B Report paging statistics. The following values are displayed:
80 pgpgin/s
82 Total number of kilobytes the system paged in from disk
83 per second.
84 pgpgout/s
86 Total number of kilobytes the system paged out to disk
87 per second.
88 fault/s
90 Number of page faults (major + minor) made by the system
91 per second. This is not a count of page faults that gen‐
92 erate I/O, because some page faults can be resolved with‐
93 out I/O.
94 majflt/s
96 Number of major faults the system has made per second,
97 those which have required loading a memory page from
98 disk.
99 pgfree/s
101 Number of pages placed on the free list by the system per
102 second.
103 pgscank/s
105 Number of pages scanned by the kswapd daemon per second.
106 pgscand/s
108 Number of pages scanned directly per second.
109 pgsteal/s
111 Number of pages the system has reclaimed from cache
112 (pagecache and swapcache) per second to satisfy its mem‐
113 ory demands.
114 %vmeff
116 Calculated as pgsteal / pgscan, this is a metric of the
117 efficiency of page reclaim. If it is near 100% then
118 almost every page coming off the tail of the inactive
119 list is being reaped. If it gets too low (e.g. less than
120 30%) then the virtual memory is having some difficulty.
121 This field is displayed as zero if no pages have been
122 scanned during the interval of time.
123 -b Report I/O and transfer rate statistics. The following values
125 are displayed:
126 tps
128 Total number of transfers per second that were issued to
129 physical devices. A transfer is an I/O request to a
130 physical device. Multiple logical requests can be com‐
131 bined into a single I/O request to the device. A trans‐
132 fer is of indeterminate size.
133 rtps
135 Total number of read requests per second issued to physi‐
136 cal devices.
137 wtps
139 Total number of write requests per second issued to phys‐
140 ical devices.
141 bread/s
143 Total amount of data read from the devices in blocks per
144 second. Blocks are equivalent to sectors and therefore
145 have a size of 512 bytes.
146 bwrtn/s
148 Total amount of data written to devices in blocks per
149 second.
150 -C When reading data from a file, tell sar to display comments that
152 have been inserted by sadc.
153 -d Report activity for each block device. When data are displayed,
155 the device specification dev m-n is generally used ( DEV col‐
156 umn). m is the major number of the device and n its minor num‐
157 ber. Device names may also be pretty-printed if option -p is
158 used or persistent device names can be printed if option -j is
159 used (see below). Note that disk activity depends on sadc
160 options "-S DISK" and "-S XDISK" to be collected. The following
161 values are displayed:
162 tps
164 Indicate the number of transfers per second that were
165 issued to the device. Multiple logical requests can be
166 combined into a single I/O request to the device. A
167 transfer is of indeterminate size.
168 rd_sec/s
170 Number of sectors read from the device. The size of a
171 sector is 512 bytes.
172 wr_sec/s
174 Number of sectors written to the device. The size of a
175 sector is 512 bytes.
176 avgrq-sz
178 The average size (in sectors) of the requests that were
179 issued to the device.
180 avgqu-sz
182 The average queue length of the requests that were issued
183 to the device.
184 await
186 The average time (in milliseconds) for I/O requests
187 issued to the device to be served. This includes the time
188 spent by the requests in queue and the time spent servic‐
189 ing them.
190 svctm
192 The average service time (in milliseconds) for I/O
193 requests that were issued to the device. Warning! Do not
194 trust this field any more. This field will be removed in
195 a future sysstat version.
196 %util
198 Percentage of elapsed time during which I/O requests were
199 issued to the device (bandwidth utilization for the
200 device). Device saturation occurs when this value is
201 close to 100%.
202 -e [ hh:mm:ss ]
204 Set the ending time of the report. The default ending time is
205 18:00:00. Hours must be given in 24-hour format. This option
206 can be used when data are read from or written to a file
207 (options -f or -o).
208 -F [ MOUNT ]
210 Display statistics for currently mounted filesystems. Pseudo-
211 filesystems are ignored. At the end of the report, sar will
212 display a summary of all those filesystems. Note that filesys‐
213 tems statistics depend on sadc option -S XDISK to be collected.
214 Use of the MOUNT parameter keyword indicates that mountpoint
215 will be reported instead of filesystem device.
216 The following values are displayed:
218 MBfsfree
220 Total amount a free space in megabytes (including space
221 available only to privileged user).
222 MBfsused
224 Total amount of space used in megabytes.
225 %fsused
227 Percentage of filesystem space used, as seen by a privi‐
228 leged user.
229 %ufsused
231 Percentage of filesystem space used, as seen by an
232 unprivileged user.
233 Ifree
235 Total number of free file nodes in filesystem.
236 Iused
238 Total number of file nodes used in filesystem.
239 %Iused
241 Percentage of file nodes used in filesystem.
242 -f [ filename ]
244 Extract records from filename (created by the -o filename flag).
245 The default value of the filename parameter is the current daily
246 data file, the /var/log/sa/sadd file. The -f option is exclusive
247 of the -o option.
248 -H Report hugepages utilization statistics. The following values
250 are displayed:
251 kbhugfree
253 Amount of hugepages memory in kilobytes that is not yet
254 allocated.
255 kbhugused
257 Amount of hugepages memory in kilobytes that has been
258 allocated.
259 %hugused
261 Percentage of total hugepages memory that has been allo‐
262 cated.
263 -h Display a short help message then exit.
265 -I { int [,...] | SUM | ALL | XALL }
267 Report statistics for a given interrupt. int is the interrupt
268 number. Specifying multiple -I int parameters on the command
269 line will look at multiple independent interrupts. The SUM key‐
270 word indicates that the total number of interrupts received per
271 second is to be displayed. The ALL keyword indicates that sta‐
272 tistics from the first 16 interrupts are to be reported, whereas
273 the XALL keyword indicates that statistics from all interrupts,
274 including potential APIC interrupt sources, are to be reported.
275 Note that interrupt statistics depend on sadc option "-S INT" to
276 be collected.
277 -i interval
279 Select data records at seconds as close as possible to the num‐
280 ber specified by the interval parameter.
281 -j { ID | LABEL | PATH | UUID | ... }
283 Display persistent device names. Use this option in conjunction
284 with option -d. Options ID, LABEL, etc. specify the type of the
285 persistent name. These options are not limited, only prerequi‐
286 site is that directory with required persistent names is present
287 in /dev/disk. If persistent name is not found for the device,
288 the device name is pretty-printed (see option -p below).
289 -m { keyword [,...] | ALL }
291 Report power management statistics. Note that these statistics
292 depend on sadc option "-S POWER" to be collected.
293 Possible keywords are CPU, FAN, FREQ, IN, TEMP and USB.
295 With the CPU keyword, statistics about CPU are reported. The
297 following value is displayed:
298 MHz
300 Instantaneous CPU clock frequency in MHz.
301 With the FAN keyword, statistics about fans speed are reported.
303 The following values are displayed:
304 rpm
306 Fan speed expressed in revolutions per minute.
307 drpm
309 This field is calculated as the difference between cur‐
310 rent fan speed (rpm) and its low limit (fan_min).
311 DEVICE
313 Sensor device name.
314 With the FREQ keyword, statistics about CPU clock frequency are
316 reported. The following value is displayed:
317 wghMHz
319 Weighted average CPU clock frequency in MHz. Note that
320 the cpufreq-stats driver must be compiled in the kernel
321 for this option to work.
322 With the IN keyword, statistics about voltage inputs are
324 reported. The following values are displayed:
325 inV
327 Voltage input expressed in Volts.
328 %in
330 Relative input value. A value of 100% means that voltage
331 input has reached its high limit (in_max) whereas a value
332 of 0% means that it has reached its low limit (in_min).
333 DEVICE
335 Sensor device name.
336 With the TEMP keyword, statistics about devices temperature are
338 reported. The following values are displayed:
339 degC
341 Device temperature expressed in degrees Celsius.
342 %temp
344 Relative device temperature. A value of 100% means that
345 temperature has reached its high limit (temp_max).
346 DEVICE
348 Sensor device name.
349 With the USB keyword, the sar command takes a snapshot of all
351 the USB devices currently plugged into the system. At the end of
352 the report, sar will display a summary of all those USB devices.
353 The following values are displayed:
354 BUS
356 Root hub number of the USB device.
357 idvendor
359 Vendor ID number (assigned by USB organization).
360 idprod
362 Product ID number (assigned by Manufacturer).
363 maxpower
365 Maximum power consumption of the device (expressed in
366 mA).
367 manufact
369 Manufacturer name.
370 product
372 Product name.
373 -n { keyword [,...] | ALL }
375 Report network statistics.
376 Possible keywords are DEV, EDEV, NFS, NFSD, SOCK, IP, EIP, ICMP,
378 EICMP, TCP, ETCP, UDP, SOCK6, IP6, EIP6, ICMP6, EICMP6 and UDP6.
379 With the DEV keyword, statistics from the network devices are
381 reported. The following values are displayed:
382 IFACE
384 Name of the network interface for which statistics are
385 reported.
386 rxpck/s
388 Total number of packets received per second.
389 txpck/s
391 Total number of packets transmitted per second.
392 rxkB/s
394 Total number of kilobytes received per second.
395 txkB/s
397 Total number of kilobytes transmitted per second.
398 rxcmp/s
400 Number of compressed packets received per second (for
401 cslip etc.).
402 txcmp/s
404 Number of compressed packets transmitted per second.
405 rxmcst/s
407 Number of multicast packets received per second.
408 With the EDEV keyword, statistics on failures (errors) from the
410 network devices are reported. The following values are dis‐
411 played:
412 IFACE
414 Name of the network interface for which statistics are
415 reported.
416 rxerr/s
418 Total number of bad packets received per second.
419 txerr/s
421 Total number of errors that happened per second while
422 transmitting packets.
423 coll/s
425 Number of collisions that happened per second while
426 transmitting packets.
427 rxdrop/s
429 Number of received packets dropped per second because of
430 a lack of space in linux buffers.
431 txdrop/s
433 Number of transmitted packets dropped per second because
434 of a lack of space in linux buffers.
435 txcarr/s
437 Number of carrier-errors that happened per second while
438 transmitting packets.
439 rxfram/s
441 Number of frame alignment errors that happened per second
442 on received packets.
443 rxfifo/s
445 Number of FIFO overrun errors that happened per second on
446 received packets.
447 txfifo/s
449 Number of FIFO overrun errors that happened per second on
450 transmitted packets.
451 With the NFS keyword, statistics about NFS client activity are
453 reported. The following values are displayed:
454 call/s
456 Number of RPC requests made per second.
457 retrans/s
459 Number of RPC requests per second, those which needed to
460 be retransmitted (for example because of a server time‐
461 out).
462 read/s
464 Number of 'read' RPC calls made per second.
465 write/s
467 Number of 'write' RPC calls made per second.
468 access/s
470 Number of 'access' RPC calls made per second.
471 getatt/s
473 Number of 'getattr' RPC calls made per second.
474 With the NFSD keyword, statistics about NFS server activity are
476 reported. The following values are displayed:
477 scall/s
479 Number of RPC requests received per second.
480 badcall/s
482 Number of bad RPC requests received per second, those
483 whose processing generated an error.
484 packet/s
486 Number of network packets received per second.
487 udp/s
489 Number of UDP packets received per second.
490 tcp/s
492 Number of TCP packets received per second.
493 hit/s
495 Number of reply cache hits per second.
496 miss/s
498 Number of reply cache misses per second.
499 sread/s
501 Number of 'read' RPC calls received per second.
502 swrite/s
504 Number of 'write' RPC calls received per second.
505 saccess/s
507 Number of 'access' RPC calls received per second.
508 sgetatt/s
510 Number of 'getattr' RPC calls received per second.
511 With the SOCK keyword, statistics on sockets in use are reported
513 (IPv4). The following values are displayed:
514 totsck
516 Total number of sockets used by the system.
517 tcpsck
519 Number of TCP sockets currently in use.
520 udpsck
522 Number of UDP sockets currently in use.
523 rawsck
525 Number of RAW sockets currently in use.
526 ip-frag
528 Number of IP fragments currently in queue.
529 tcp-tw
531 Number of TCP sockets in TIME_WAIT state.
532 With the IP keyword, statistics about IPv4 network traffic are
534 reported. Note that IPv4 statistics depend on sadc option "-S
535 SNMP" to be collected. The following values are displayed (for‐
536 mal SNMP names between square brackets):
537 irec/s
539 The total number of input datagrams received from inter‐
540 faces per second, including those received in error
541 [ipInReceives].
542 fwddgm/s
544 The number of input datagrams per second, for which this
545 entity was not their final IP destination, as a result of
546 which an attempt was made to find a route to forward them
547 to that final destination [ipForwDatagrams].
548 idel/s
550 The total number of input datagrams successfully deliv‐
551 ered per second to IP user-protocols (including ICMP)
552 [ipInDelivers].
553 orq/s
555 The total number of IP datagrams which local IP user-pro‐
556 tocols (including ICMP) supplied per second to IP in
557 requests for transmission [ipOutRequests]. Note that
558 this counter does not include any datagrams counted in
559 fwddgm/s.
560 asmrq/s
562 The number of IP fragments received per second which
563 needed to be reassembled at this entity [ipReasmReqds].
564 asmok/s
566 The number of IP datagrams successfully re-assembled per
567 second [ipReasmOKs].
568 fragok/s
570 The number of IP datagrams that have been successfully
571 fragmented at this entity per second [ipFragOKs].
572 fragcrt/s
574 The number of IP datagram fragments that have been gener‐
575 ated per second as a result of fragmentation at this
576 entity [ipFragCreates].
577 With the EIP keyword, statistics about IPv4 network errors are
579 reported. Note that IPv4 statistics depend on sadc option "-S
580 SNMP" to be collected. The following values are displayed (for‐
581 mal SNMP names between square brackets):
582 ihdrerr/s
584 The number of input datagrams discarded per second due to
585 errors in their IP headers, including bad checksums, ver‐
586 sion number mismatch, other format errors, time-to-live
587 exceeded, errors discovered in processing their IP
588 options, etc. [ipInHdrErrors]
589 iadrerr/s
591 The number of input datagrams discarded per second
592 because the IP address in their IP header's destination
593 field was not a valid address to be received at this
594 entity. This count includes invalid addresses (e.g.,
595 0.0.0.0) and addresses of unsupported Classes (e.g.,
596 Class E). For entities which are not IP routers and
597 therefore do not forward datagrams, this counter includes
598 datagrams discarded because the destination address was
599 not a local address [ipInAddrErrors].
600 iukwnpr/s
602 The number of locally-addressed datagrams received suc‐
603 cessfully but discarded per second because of an unknown
604 or unsupported protocol [ipInUnknownProtos].
605 idisc/s
607 The number of input IP datagrams per second for which no
608 problems were encountered to prevent their continued pro‐
609 cessing, but which were discarded (e.g., for lack of buf‐
610 fer space) [ipInDiscards]. Note that this counter does
611 not include any datagrams discarded while awaiting re-
612 assembly.
613 odisc/s
615 The number of output IP datagrams per second for which no
616 problem was encountered to prevent their transmission to
617 their destination, but which were discarded (e.g., for
618 lack of buffer space) [ipOutDiscards]. Note that this
619 counter would include datagrams counted in fwddgm/s if
620 any such packets met this (discretionary) discard crite‐
621 rion.
622 onort/s
624 The number of IP datagrams discarded per second because
625 no route could be found to transmit them to their desti‐
626 nation [ipOutNoRoutes]. Note that this counter includes
627 any packets counted in fwddgm/s which meet this 'no-
628 route' criterion. Note that this includes any datagrams
629 which a host cannot route because all of its default
630 routers are down.
631 asmf/s
633 The number of failures detected per second by the IP re-
634 assembly algorithm (for whatever reason: timed out,
635 errors, etc) [ipReasmFails]. Note that this is not nec‐
636 essarily a count of discarded IP fragments since some
637 algorithms can lose track of the number of fragments by
638 combining them as they are received.
639 fragf/s
641 The number of IP datagrams that have been discarded per
642 second because they needed to be fragmented at this
643 entity but could not be, e.g., because their Don't Frag‐
644 ment flag was set [ipFragFails].
645 With the ICMP keyword, statistics about ICMPv4 network traffic
647 are reported. Note that ICMPv4 statistics depend on sadc option
648 "-S SNMP" to be collected. The following values are displayed
649 (formal SNMP names between square brackets):
650 imsg/s
652 The total number of ICMP messages which the entity
653 received per second [icmpInMsgs]. Note that this counter
654 includes all those counted by ierr/s.
655 omsg/s
657 The total number of ICMP messages which this entity
658 attempted to send per second [icmpOutMsgs]. Note that
659 this counter includes all those counted by oerr/s.
660 iech/s
662 The number of ICMP Echo (request) messages received per
663 second [icmpInEchos].
664 iechr/s
666 The number of ICMP Echo Reply messages received per sec‐
667 ond [icmpInEchoReps].
668 oech/s
670 The number of ICMP Echo (request) messages sent per sec‐
671 ond [icmpOutEchos].
672 oechr/s
674 The number of ICMP Echo Reply messages sent per second
675 [icmpOutEchoReps].
676 itm/s
678 The number of ICMP Timestamp (request) messages received
679 per second [icmpInTimestamps].
680 itmr/s
682 The number of ICMP Timestamp Reply messages received per
683 second [icmpInTimestampReps].
684 otm/s
686 The number of ICMP Timestamp (request) messages sent per
687 second [icmpOutTimestamps].
688 otmr/s
690 The number of ICMP Timestamp Reply messages sent per sec‐
691 ond [icmpOutTimestampReps].
692 iadrmk/s
694 The number of ICMP Address Mask Request messages received
695 per second [icmpInAddrMasks].
696 iadrmkr/s
698 The number of ICMP Address Mask Reply messages received
699 per second [icmpInAddrMaskReps].
700 oadrmk/s
702 The number of ICMP Address Mask Request messages sent per
703 second [icmpOutAddrMasks].
704 oadrmkr/s
706 The number of ICMP Address Mask Reply messages sent per
707 second [icmpOutAddrMaskReps].
708 With the EICMP keyword, statistics about ICMPv4 error messages
710 are reported. Note that ICMPv4 statistics depend on sadc option
711 "-S SNMP" to be collected. The following values are displayed
712 (formal SNMP names between square brackets):
713 ierr/s
715 The number of ICMP messages per second which the entity
716 received but determined as having ICMP-specific errors
717 (bad ICMP checksums, bad length, etc.) [icmpInErrors].
718 oerr/s
720 The number of ICMP messages per second which this entity
721 did not send due to problems discovered within ICMP such
722 as a lack of buffers [icmpOutErrors].
723 idstunr/s
725 The number of ICMP Destination Unreachable messages
726 received per second [icmpInDestUnreachs].
727 odstunr/s
729 The number of ICMP Destination Unreachable messages sent
730 per second [icmpOutDestUnreachs].
731 itmex/s
733 The number of ICMP Time Exceeded messages received per
734 second [icmpInTimeExcds].
735 otmex/s
737 The number of ICMP Time Exceeded messages sent per second
738 [icmpOutTimeExcds].
739 iparmpb/s
741 The number of ICMP Parameter Problem messages received
742 per second [icmpInParmProbs].
743 oparmpb/s
745 The number of ICMP Parameter Problem messages sent per
746 second [icmpOutParmProbs].
747 isrcq/s
749 The number of ICMP Source Quench messages received per
750 second [icmpInSrcQuenchs].
751 osrcq/s
753 The number of ICMP Source Quench messages sent per second
754 [icmpOutSrcQuenchs].
755 iredir/s
757 The number of ICMP Redirect messages received per second
758 [icmpInRedirects].
759 oredir/s
761 The number of ICMP Redirect messages sent per second
762 [icmpOutRedirects].
763 With the TCP keyword, statistics about TCPv4 network traffic are
765 reported. Note that TCPv4 statistics depend on sadc option "-S
766 SNMP" to be collected. The following values are displayed (for‐
767 mal SNMP names between square brackets):
768 active/s
770 The number of times TCP connections have made a direct
771 transition to the SYN-SENT state from the CLOSED state
772 per second [tcpActiveOpens].
773 passive/s
775 The number of times TCP connections have made a direct
776 transition to the SYN-RCVD state from the LISTEN state
777 per second [tcpPassiveOpens].
778 iseg/s
780 The total number of segments received per second, includ‐
781 ing those received in error [tcpInSegs]. This count
782 includes segments received on currently established con‐
783 nections.
784 oseg/s
786 The total number of segments sent per second, including
787 those on current connections but excluding those contain‐
788 ing only retransmitted octets [tcpOutSegs].
789 With the ETCP keyword, statistics about TCPv4 network errors are
791 reported. Note that TCPv4 statistics depend on sadc option "-S
792 SNMP" to be collected. The following values are displayed (for‐
793 mal SNMP names between square brackets):
794 atmptf/s
796 The number of times per second TCP connections have made
797 a direct transition to the CLOSED state from either the
798 SYN-SENT state or the SYN-RCVD state, plus the number of
799 times per second TCP connections have made a direct tran‐
800 sition to the LISTEN state from the SYN-RCVD state
801 [tcpAttemptFails].
802 estres/s
804 The number of times per second TCP connections have made
805 a direct transition to the CLOSED state from either the
806 ESTABLISHED state or the CLOSE-WAIT state [tcpEstabRe‐
807 sets].
808 retrans/s
810 The total number of segments retransmitted per second -
811 that is, the number of TCP segments transmitted contain‐
812 ing one or more previously transmitted octets [tcpRe‐
813 transSegs].
814 isegerr/s
816 The total number of segments received in error (e.g., bad
817 TCP checksums) per second [tcpInErrs].
818 orsts/s
820 The number of TCP segments sent per second containing the
821 RST flag [tcpOutRsts].
822 With the UDP keyword, statistics about UDPv4 network traffic are
824 reported. Note that UDPv4 statistics depend on sadc option "-S
825 SNMP" to be collected. The following values are displayed (for‐
826 mal SNMP names between square brackets):
827 idgm/s
829 The total number of UDP datagrams delivered per second to
830 UDP users [udpInDatagrams].
831 odgm/s
833 The total number of UDP datagrams sent per second from
834 this entity [udpOutDatagrams].
835 noport/s
837 The total number of received UDP datagrams per second for
838 which there was no application at the destination port
839 [udpNoPorts].
840 idgmerr/s
842 The number of received UDP datagrams per second that
843 could not be delivered for reasons other than the lack of
844 an application at the destination port [udpInErrors].
845 With the SOCK6 keyword, statistics on sockets in use are
847 reported (IPv6). Note that IPv6 statistics depend on sadc
848 option "-S IPV6" to be collected. The following values are dis‐
849 played:
850 tcp6sck
852 Number of TCPv6 sockets currently in use.
853 udp6sck
855 Number of UDPv6 sockets currently in use.
856 raw6sck
858 Number of RAWv6 sockets currently in use.
859 ip6-frag
861 Number of IPv6 fragments currently in use.
862 With the IP6 keyword, statistics about IPv6 network traffic are
864 reported. Note that IPv6 statistics depend on sadc option "-S
865 IPV6" to be collected. The following values are displayed (for‐
866 mal SNMP names between square brackets):
867 irec6/s
869 The total number of input datagrams received from inter‐
870 faces per second, including those received in error
871 [ipv6IfStatsInReceives].
872 fwddgm6/s
874 The number of output datagrams per second which this
875 entity received and forwarded to their final destinations
876 [ipv6IfStatsOutForwDatagrams].
877 idel6/s
879 The total number of datagrams successfully delivered per
880 second to IPv6 user-protocols (including ICMP) [ipv6IfS‐
881 tatsInDelivers].
882 orq6/s
884 The total number of IPv6 datagrams which local IPv6 user-
885 protocols (including ICMP) supplied per second to IPv6 in
886 requests for transmission [ipv6IfStatsOutRequests]. Note
887 that this counter does not include any datagrams counted
888 in fwddgm6/s.
889 asmrq6/s
891 The number of IPv6 fragments received per second which
892 needed to be reassembled at this interface [ipv6IfStat‐
893 sReasmReqds].
894 asmok6/s
896 The number of IPv6 datagrams successfully reassembled per
897 second [ipv6IfStatsReasmOKs].
898 imcpck6/s
900 The number of multicast packets received per second by
901 the interface [ipv6IfStatsInMcastPkts].
902 omcpck6/s
904 The number of multicast packets transmitted per second by
905 the interface [ipv6IfStatsOutMcastPkts].
906 fragok6/s
908 The number of IPv6 datagrams that have been successfully
909 fragmented at this output interface per second [ipv6IfS‐
910 tatsOutFragOKs].
911 fragcr6/s
913 The number of output datagram fragments that have been
914 generated per second as a result of fragmentation at this
915 output interface [ipv6IfStatsOutFragCreates].
916 With the EIP6 keyword, statistics about IPv6 network errors are
918 reported. Note that IPv6 statistics depend on sadc option "-S
919 IPV6" to be collected. The following values are displayed (for‐
920 mal SNMP names between square brackets):
921 ihdrer6/s
923 The number of input datagrams discarded per second due to
924 errors in their IPv6 headers, including version number
925 mismatch, other format errors, hop count exceeded, errors
926 discovered in processing their IPv6 options, etc.
927 [ipv6IfStatsInHdrErrors]
928 iadrer6/s
930 The number of input datagrams discarded per second
931 because the IPv6 address in their IPv6 header's destina‐
932 tion field was not a valid address to be received at this
933 entity. This count includes invalid addresses (e.g., ::0)
934 and unsupported addresses (e.g., addresses with unallo‐
935 cated prefixes). For entities which are not IPv6 routers
936 and therefore do not forward datagrams, this counter
937 includes datagrams discarded because the destination
938 address was not a local address [ipv6IfStatsInAddr‐
939 Errors].
940 iukwnp6/s
942 The number of locally-addressed datagrams received suc‐
943 cessfully but discarded per second because of an unknown
944 or unsupported protocol [ipv6IfStatsInUnknownProtos].
945 i2big6/s
947 The number of input datagrams that could not be forwarded
948 per second because their size exceeded the link MTU of
949 outgoing interface [ipv6IfStatsInTooBigErrors].
950 idisc6/s
952 The number of input IPv6 datagrams per second for which
953 no problems were encountered to prevent their continued
954 processing, but which were discarded (e.g., for lack of
955 buffer space) [ipv6IfStatsInDiscards]. Note that this
956 counter does not include any datagrams discarded while
957 awaiting re-assembly.
958 odisc6/s
960 The number of output IPv6 datagrams per second for which
961 no problem was encountered to prevent their transmission
962 to their destination, but which were discarded (e.g., for
963 lack of buffer space) [ipv6IfStatsOutDiscards]. Note that
964 this counter would include datagrams counted in fwddgm6/s
965 if any such packets met this (discretionary) discard cri‐
966 terion.
967 inort6/s
969 The number of input datagrams discarded per second
970 because no route could be found to transmit them to their
971 destination [ipv6IfStatsInNoRoutes].
972 onort6/s
974 The number of locally generated IP datagrams discarded
975 per second because no route could be found to transmit
976 them to their destination [unknown formal SNMP name].
977 asmf6/s
979 The number of failures detected per second by the IPv6
980 re-assembly algorithm (for whatever reason: timed out,
981 errors, etc.) [ipv6IfStatsReasmFails]. Note that this is
982 not necessarily a count of discarded IPv6 fragments since
983 some algorithms can lose track of the number of fragments
984 by combining them as they are received.
985 fragf6/s
987 The number of IPv6 datagrams that have been discarded per
988 second because they needed to be fragmented at this out‐
989 put interface but could not be [ipv6IfStatsOutFragFails].
990 itrpck6/s
992 The number of input datagrams discarded per second
993 because datagram frame didn't carry enough data [ipv6IfS‐
994 tatsInTruncatedPkts].
995 With the ICMP6 keyword, statistics about ICMPv6 network traffic
997 are reported. Note that ICMPv6 statistics depend on sadc option
998 "-S IPV6" to be collected. The following values are displayed
999 (formal SNMP names between square brackets):
1000 imsg6/s
1002 The total number of ICMP messages received by the inter‐
1003 face per second which includes all those counted by
1004 ierr6/s [ipv6IfIcmpInMsgs].
1005 omsg6/s
1007 The total number of ICMP messages which this interface
1008 attempted to send per second [ipv6IfIcmpOutMsgs].
1009 iech6/s
1011 The number of ICMP Echo (request) messages received by
1012 the interface per second [ipv6IfIcmpInEchos].
1013 iechr6/s
1015 The number of ICMP Echo Reply messages received by the
1016 interface per second [ipv6IfIcmpInEchoReplies].
1017 oechr6/s
1019 The number of ICMP Echo Reply messages sent by the inter‐
1020 face per second [ipv6IfIcmpOutEchoReplies].
1021 igmbq6/s
1023 The number of ICMPv6 Group Membership Query messages
1024 received by the interface per second [ipv6IfIcmpInGroup‐
1025 MembQueries].
1026 igmbr6/s
1028 The number of ICMPv6 Group Membership Response messages
1029 received by the interface per second [ipv6IfIcmpInGroup‐
1030 MembResponses].
1031 ogmbr6/s
1033 The number of ICMPv6 Group Membership Response messages
1034 sent per second [ipv6IfIcmpOutGroupMembResponses].
1035 igmbrd6/s
1037 The number of ICMPv6 Group Membership Reduction messages
1038 received by the interface per second [ipv6IfIcmpInGroup‐
1039 MembReductions].
1040 ogmbrd6/s
1042 The number of ICMPv6 Group Membership Reduction messages
1043 sent per second [ipv6IfIcmpOutGroupMembReductions].
1044 irtsol6/s
1046 The number of ICMP Router Solicit messages received by
1047 the interface per second [ipv6IfIcmpInRouterSolicits].
1048 ortsol6/s
1050 The number of ICMP Router Solicitation messages sent by
1051 the interface per second [ipv6IfIcmpOutRouterSolicits].
1052 irtad6/s
1054 The number of ICMP Router Advertisement messages received
1055 by the interface per second [ipv6IfIcmpInRouterAdvertise‐
1056 ments].
1057 inbsol6/s
1059 The number of ICMP Neighbor Solicit messages received by
1060 the interface per second [ipv6IfIcmpInNeighborSolicits].
1061 onbsol6/s
1063 The number of ICMP Neighbor Solicitation messages sent by
1064 the interface per second [ipv6IfIcmpOutNeighborSolicits].
1065 inbad6/s
1067 The number of ICMP Neighbor Advertisement messages
1068 received by the interface per second [ipv6IfIcmpInNeighb‐
1069 orAdvertisements].
1070 onbad6/s
1072 The number of ICMP Neighbor Advertisement messages sent
1073 by the interface per second [ipv6IfIcmpOutNeighborAdver‐
1074 tisements].
1075 With the EICMP6 keyword, statistics about ICMPv6 error messages
1077 are reported. Note that ICMPv6 statistics depend on sadc option
1078 "-S IPV6" to be collected. The following values are displayed
1079 (formal SNMP names between square brackets):
1080 ierr6/s
1082 The number of ICMP messages per second which the inter‐
1083 face received but determined as having ICMP-specific
1084 errors (bad ICMP checksums, bad length, etc.)
1085 [ipv6IfIcmpInErrors]
1086 idtunr6/s
1088 The number of ICMP Destination Unreachable messages
1089 received by the interface per second [ipv6IfIcmpInDestUn‐
1090 reachs].
1091 odtunr6/s
1093 The number of ICMP Destination Unreachable messages sent
1094 by the interface per second [ipv6IfIcmpOutDestUnreachs].
1095 itmex6/s
1097 The number of ICMP Time Exceeded messages received by the
1098 interface per second [ipv6IfIcmpInTimeExcds].
1099 otmex6/s
1101 The number of ICMP Time Exceeded messages sent by the
1102 interface per second [ipv6IfIcmpOutTimeExcds].
1103 iprmpb6/s
1105 The number of ICMP Parameter Problem messages received by
1106 the interface per second [ipv6IfIcmpInParmProblems].
1107 oprmpb6/s
1109 The number of ICMP Parameter Problem messages sent by the
1110 interface per second [ipv6IfIcmpOutParmProblems].
1111 iredir6/s
1113 The number of Redirect messages received by the interface
1114 per second [ipv6IfIcmpInRedirects].
1115 oredir6/s
1117 The number of Redirect messages sent by the interface by
1118 second [ipv6IfIcmpOutRedirects].
1119 ipck2b6/s
1121 The number of ICMP Packet Too Big messages received by
1122 the interface per second [ipv6IfIcmpInPktTooBigs].
1123 opck2b6/s
1125 The number of ICMP Packet Too Big messages sent by the
1126 interface per second [ipv6IfIcmpOutPktTooBigs].
1127 With the UDP6 keyword, statistics about UDPv6 network traffic
1129 are reported. Note that UDPv6 statistics depend on sadc option
1130 "-S IPV6" to be collected. The following values are displayed
1131 (formal SNMP names between square brackets):
1132 idgm6/s
1134 The total number of UDP datagrams delivered per second to
1135 UDP users [udpInDatagrams].
1136 odgm6/s
1138 The total number of UDP datagrams sent per second from
1139 this entity [udpOutDatagrams].
1140 noport6/s
1142 The total number of received UDP datagrams per second for
1143 which there was no application at the destination port
1144 [udpNoPorts].
1145 idgmer6/s
1147 The number of received UDP datagrams per second that
1148 could not be delivered for reasons other than the lack of
1149 an application at the destination port [udpInErrors].
1150 The ALL keyword is equivalent to specifying all the keywords
1152 above and therefore all the network activities are reported.
1153 -o [ filename ]
1155 Save the readings in the file in binary form. Each reading is in
1156 a separate record. The default value of the filename parameter
1157 is the current daily data file, the /var/log/sa/sadd file. The
1158 -o option is exclusive of the -f option. All the data available
1159 from the kernel are saved in the file (in fact, sar calls its
1160 data collector sadc with the option "-S ALL". See sadc(8) manual
1161 page).
1162 -P { cpu [,...] | ALL }
1164 Report per-processor statistics for the specified processor or
1165 processors. Specifying the ALL keyword reports statistics for
1166 each individual processor, and globally for all processors.
1167 Note that processor 0 is the first processor.
1168 -p Pretty-print device names. Use this option in conjunction with
1170 option -d. By default names are printed as dev m-n where m and
1171 n are the major and minor numbers for the device. Use of this
1172 option displays the names of the devices as they (should) appear
1173 in /dev. Name mappings are controlled by /etc/sysconfig/sys‐
1174 stat.ioconf.
1175 -q Report queue length and load averages. The following values are
1177 displayed:
1178 runq-sz
1180 Run queue length (number of tasks waiting for run time).
1181 plist-sz
1183 Number of tasks in the task list.
1184 ldavg-1
1186 System load average for the last minute. The load aver‐
1187 age is calculated as the average number of runnable or
1188 running tasks (R state), and the number of tasks in unin‐
1189 terruptible sleep (D state) over the specified interval.
1190 ldavg-5
1192 System load average for the past 5 minutes.
1193 ldavg-15
1195 System load average for the past 15 minutes.
1196 blocked
1198 Number of tasks currently blocked, waiting for I/O to
1199 complete.
1200 -R Report memory statistics. The following values are displayed:
1202 frmpg/s
1204 Number of memory pages freed by the system per second. A
1205 negative value represents a number of pages allocated by
1206 the system. Note that a page has a size of 4 kB or 8 kB
1207 according to the machine architecture.
1208 bufpg/s
1210 Number of additional memory pages used as buffers by the
1211 system per second. A negative value means fewer pages
1212 used as buffers by the system.
1213 campg/s
1215 Number of additional memory pages cached by the system
1216 per second. A negative value means fewer pages in the
1217 cache.
1218 -r Report memory utilization statistics. The following values are
1220 displayed:
1221 kbmemfree
1223 Amount of free memory available in kilobytes.
1224 kbmemused
1226 Amount of used memory in kilobytes. This does not take
1227 into account memory used by the kernel itself.
1228 %memused
1230 Percentage of used memory.
1231 kbbuffers
1233 Amount of memory used as buffers by the kernel in kilo‐
1234 bytes.
1235 kbcached
1237 Amount of memory used to cache data by the kernel in
1238 kilobytes.
1239 kbcommit
1241 Amount of memory in kilobytes needed for current work‐
1242 load. This is an estimate of how much RAM/swap is needed
1243 to guarantee that there never is out of memory.
1244 %commit
1246 Percentage of memory needed for current workload in rela‐
1247 tion to the total amount of memory (RAM+swap). This num‐
1248 ber may be greater than 100% because the kernel usually
1249 overcommits memory.
1250 kbactive
1252 Amount of active memory in kilobytes (memory that has
1253 been used more recently and usually not reclaimed unless
1254 absolutely necessary).
1255 kbinact
1257 Amount of inactive memory in kilobytes (memory which has
1258 been less recently used. It is more eligible to be
1259 reclaimed for other purposes).
1260 kbdirty
1262 Amount of memory in kilobytes waiting to get written back
1263 to the disk.
1264 -S Report swap space utilization statistics. The following values
1266 are displayed:
1267 kbswpfree
1269 Amount of free swap space in kilobytes.
1270 kbswpused
1272 Amount of used swap space in kilobytes.
1273 %swpused
1275 Percentage of used swap space.
1276 kbswpcad
1278 Amount of cached swap memory in kilobytes. This is mem‐
1279 ory that once was swapped out, is swapped back in but
1280 still also is in the swap area (if memory is needed it
1281 doesn't need to be swapped out again because it is
1282 already in the swap area. This saves I/O).
1283 %swpcad
1285 Percentage of cached swap memory in relation to the
1286 amount of used swap space.
1287 -s [ hh:mm:ss ]
1289 Set the starting time of the data, causing the sar command to
1290 extract records time-tagged at, or following, the time speci‐
1291 fied. The default starting time is 08:00:00. Hours must be
1292 given in 24-hour format. This option can be used only when data
1293 are read from a file (option -f ).
1294 -t When reading data from a daily data file, indicate that sar
1296 should display the timestamps in the original local time of the
1297 data file creator. Without this option, the sar command displays
1298 the timestamps in the user's locale time.
1299 -u [ ALL ]
1301 Report CPU utilization. The ALL keyword indicates that all the
1302 CPU fields should be displayed. The report may show the follow‐
1303 ing fields:
1304 %user
1306 Percentage of CPU utilization that occurred while execut‐
1307 ing at the user level (application). Note that this field
1308 includes time spent running virtual processors.
1309 %usr
1311 Percentage of CPU utilization that occurred while execut‐
1312 ing at the user level (application). Note that this field
1313 does NOT include time spent running virtual processors.
1314 %nice
1316 Percentage of CPU utilization that occurred while execut‐
1317 ing at the user level with nice priority.
1318 %system
1320 Percentage of CPU utilization that occurred while execut‐
1321 ing at the system level (kernel). Note that this field
1322 includes time spent servicing hardware and software
1323 interrupts.
1324 %sys
1326 Percentage of CPU utilization that occurred while execut‐
1327 ing at the system level (kernel). Note that this field
1328 does NOT include time spent servicing hardware or soft‐
1329 ware interrupts.
1330 %iowait
1332 Percentage of time that the CPU or CPUs were idle during
1333 which the system had an outstanding disk I/O request.
1334 %steal
1336 Percentage of time spent in involuntary wait by the vir‐
1337 tual CPU or CPUs while the hypervisor was servicing
1338 another virtual processor.
1339 %irq
1341 Percentage of time spent by the CPU or CPUs to service
1342 hardware interrupts.
1343 %soft
1345 Percentage of time spent by the CPU or CPUs to service
1346 software interrupts.
1347 %guest
1349 Percentage of time spent by the CPU or CPUs to run a vir‐
1350 tual processor.
1351 %gnice
1353 Percentage of time spent by the CPU or CPUs to run a
1354 niced guest.
1355 %idle
1357 Percentage of time that the CPU or CPUs were idle and the
1358 system did not have an outstanding disk I/O request.
1359 Note: On SMP machines a processor that does not have any activ‐
1361 ity at all (0.00 for every field) is a disabled (offline) pro‐
1362 cessor.
1363 -V Print version number then exit.
1365 -v Report status of inode, file and other kernel tables. The fol‐
1367 lowing values are displayed:
1368 dentunusd
1370 Number of unused cache entries in the directory cache.
1371 file-nr
1373 Number of file handles used by the system.
1374 inode-nr
1376 Number of inode handlers used by the system.
1377 pty-nr
1379 Number of pseudo-terminals used by the system.
1380 -W Report swapping statistics. The following values are displayed:
1382 pswpin/s
1384 Total number of swap pages the system brought in per sec‐
1385 ond.
1386 pswpout/s
1388 Total number of swap pages the system brought out per
1389 second.
1390 -w Report task creation and system switching activity.
1392 proc/s
1394 Total number of tasks created per second.
1395 cswch/s
1397 Total number of context switches per second.
1398 -y Report TTY device activity. The following values are displayed:
1400 rcvin/s
1402 Number of receive interrupts per second for current
1403 serial line. Serial line number is given in the TTY col‐
1404 umn.
1405 xmtin/s
1407 Number of transmit interrupts per second for current
1408 serial line.
1409 framerr/s
1411 Number of frame errors per second for current serial
1412 line.
1413 prtyerr/s
1415 Number of parity errors per second for current serial
1416 line.
1417 brk/s
1419 Number of breaks per second for current serial line.
1420 ovrun/s
1422 Number of overrun errors per second for current serial
1423 line.
1424
1427 The sar command takes into account the following environment variables:
1428 S_TIME_FORMAT
1431 If this variable exists and its value is ISO then the current
1432 locale will be ignored when printing the date in the report
1433 header. The sar command will use the ISO 8601 format (YYYY-MM-
1434 DD) instead.
1435 S_TIME_DEF_TIME
1438 If this variable exists and its value is UTC then sar will save
1439 its data in UTC time (data will still be displayed in local
1440 time). sar will also use UTC time instead of local time to
1441 determine the current daily data file located in the /var/log/sa
1442 directory. This variable may be useful for servers with users
1443 located across several timezones.
1444
1446 sar -u 2 5
1447 Report CPU utilization for each 2 seconds. 5 lines are dis‐
1448 played.
1449 sar -I 14 -o int14.file 2 10
1451 Report statistics on IRQ 14 for each 2 seconds. 10 lines are
1452 displayed. Data are stored in a file called int14.file.
1453 sar -r -n DEV -f /var/log/sa/sa16
1455 Display memory and network statistics saved in daily data file
1456 'sa16'.
1457 sar -A
1459 Display all the statistics saved in current daily data file.
1460
1462 /proc filesystem must be mounted for the sar command to work.
1463 All the statistics are not necessarily available, depending on the ker‐
1465 nel version used. sar assumes that you are using at least a 2.6 ker‐
1466 nel.
1467
1469 /var/log/sa/sadd
1470 Indicate the daily data file, where the dd parameter is a number
1471 representing the day of the month.
1472 /proc contains various files with system statistics.
1474
1476 Sebastien Godard (sysstat <at> orange.fr)
1477
1479 sadc(8), sa1(8), sa2(8), sadf(1), pidstat(1), mpstat(1), iostat(1),
1480 vmstat(8)
1481 http://pagesperso-orange.fr/sebastien.godard/
1483Linux SEPTEMBER 2012 SAR(1)