1SAR(1) Linux User's Manual SAR(1)
2
6 sar - Collect, report, or save system activity information.
7
9 sar [ -A ] [ -b ] [ -B ] [ -C ] [ -d ] [ -h ] [ -i interval ] [ -m ] [
10 -p ] [ -q ] [ -r ] [ -R ] [ -S ] [ -t ] [ -u [ ALL ] ] [ -v ] [ -V ] [
11 -w ] [ -W ] [ -y ] [ -n { keyword [,...] | ALL } ] [ -I { int [,...] |
12 SUM | ALL | XALL } ] [ -P { cpu [,...] | ALL } ] [ -o [ filename ] | -f
13 [ filename ] ] [ -s [ hh:mm:ss ] ] [ -e [ hh:mm:ss ] ] [ interval [
14 count ] ]
15
17 The sar command writes to standard output the contents of selected
18 cumulative activity counters in the operating system. The accounting
19 system, based on the values in the count and interval parameters,
20 writes information the specified number of times spaced at the speci‐
21 fied intervals in seconds. If the interval parameter is set to zero,
22 the sar command displays the average statistics for the time since the
23 system was started. If the interval parameter is specified without the
24 count parameter, then reports are generated continuously. The col‐
25 lected data can also be saved in the file specified by the -o filename
26 flag, in addition to being displayed onto the screen. If filename is
27 omitted, sar uses the standard system activity daily data file, the
28 /var/log/sa/sadd file, where the dd parameter indicates the current
29 day. By default all the data available from the kernel are saved in
30 the data file.
31 The sar command extracts and writes to standard output records previ‐
33 ously saved in a file. This file can be either the one specified by the
34 -f flag or, by default, the standard system activity daily data file.
35 Without the -P flag, the sar command reports system-wide (global among
37 all processors) statistics, which are calculated as averages for values
38 expressed as percentages, and as sums otherwise. If the -P flag is
39 given, the sar command reports activity which relates to the specified
40 processor or processors. If -P ALL is given, the sar command reports
41 statistics for each individual processor and global statistics among
42 all processors.
43 You can select information about specific system activities using
45 flags. Not specifying any flags selects only CPU activity. Specifying
46 the -A flag is equivalent to specifying -bBdqrRSvwWy -I SUM -I XALL -n
47 ALL -u ALL -P ALL.
48 The default version of the sar command (CPU utilization report) might
50 be one of the first facilities the user runs to begin system activity
51 investigation, because it monitors major system resources. If CPU uti‐
52 lization is near 100 percent (user + nice + system), the workload sam‐
53 pled is CPU-bound.
54 If multiple samples and multiple reports are desired, it is convenient
56 to specify an output file for the sar command. Run the sar command as
57 a background process. The syntax for this is:
58 sar -o datafile interval count >/dev/null 2>&1 &
60 All data is captured in binary form and saved to a file (datafile).
62 The data can then be selectively displayed with the sar command using
63 the -f option. Set the interval and count parameters to select count
64 records at interval second intervals. If the count parameter is not
65 set, all the records saved in the file will be selected. Collection of
66 data in this manner is useful to characterize system usage over a
67 period of time and determine peak usage hours.
68 Note: The sar command only reports on local activities.
70
73 -A This is equivalent to specifying -bBdqrRSuvwWy -I SUM -I XALL -n
74 ALL -u ALL -P ALL.
75 -b Report I/O and transfer rate statistics. The following values
77 are displayed:
78 tps
80 Total number of transfers per second that were issued to
81 physical devices. A transfer is an I/O request to a
82 physical device. Multiple logical requests can be com‐
83 bined into a single I/O request to the device. A trans‐
84 fer is of indeterminate size.
85 rtps
87 Total number of read requests per second issued to physi‐
88 cal devices.
89 wtps
91 Total number of write requests per second issued to phys‐
92 ical devices.
93 bread/s
95 Total amount of data read from the devices in blocks per
96 second. Blocks are equivalent to sectors with 2.4 ker‐
97 nels and newer and therefore have a size of 512 bytes.
98 With older kernels, a block is of indeterminate size.
99 bwrtn/s
101 Total amount of data written to devices in blocks per
102 second.
103 -B Report paging statistics. Some of the metrics below are avail‐
105 able only with post 2.5 kernels. The following values are dis‐
106 played:
107 pgpgin/s
109 Total number of kilobytes the system paged in from disk
110 per second. Note: With old kernels (2.2.x) this value is
111 a number of blocks per second (and not kilobytes).
112 pgpgout/s
114 Total number of kilobytes the system paged out to disk
115 per second. Note: With old kernels (2.2.x) this value is
116 a number of blocks per second (and not kilobytes).
117 fault/s
119 Number of page faults (major + minor) made by the system
120 per second. This is not a count of page faults that gen‐
121 erate I/O, because some page faults can be resolved with‐
122 out I/O.
123 majflt/s
125 Number of major faults the system has made per second,
126 those which have required loading a memory page from
127 disk.
128 pgfree/s
130 Number of pages placed on the free list by the system per
131 second.
132 pgscank/s
134 Number of pages scanned by the kswapd daemon per second.
135 pgscand/s
137 Number of pages scanned directly per second.
138 pgsteal/s
140 Number of pages the system has reclaimed from cache
141 (pagecache and swapcache) per second to satisfy its mem‐
142 ory demands.
143 %vmeff
145 Calculated as pgsteal / pgscan, this is a metric of the
146 efficiency of page reclaim. If it is near 100% then
147 almost every page coming off the tail of the inactive
148 list is being reaped. If it gets too low (e.g. less than
149 30%) then the virtual memory is having some difficulty.
150 This field is displayed as zero if no pages have been
151 scanned during the interval of time.
152 -C When reading data from a file, tell sar to display comments that
154 have been inserted by sadc.
155 -d Report activity for each block device (kernels 2.4 and newer
157 only). When data is displayed, the device specification dev m-n
158 is generally used ( DEV column). m is the major number of the
159 device. With recent kernels (post 2.5), n is the minor number
160 of the device, but is only a sequence number with pre 2.5 ker‐
161 nels. Device names may also be pretty-printed if option -p is
162 used (see below). Values for fields avgqu-sz, await, svctm and
163 %util may be unavailable and displayed as 0.00 with some 2.4
164 kernels. Note that disk activity depends on sadc options "-S
165 DISK" and "-S XDISK" to be collected. The following values are
166 displayed:
167 tps
169 Indicate the number of transfers per second that were
170 issued to the device. Multiple logical requests can be
171 combined into a single I/O request to the device. A
172 transfer is of indeterminate size.
173 rd_sec/s
175 Number of sectors read from the device. The size of a
176 sector is 512 bytes.
177 wr_sec/s
179 Number of sectors written to the device. The size of a
180 sector is 512 bytes.
181 avgrq-sz
183 The average size (in sectors) of the requests that were
184 issued to the device.
185 avgqu-sz
187 The average queue length of the requests that were issued
188 to the device.
189 await
191 The average time (in milliseconds) for I/O requests
192 issued to the device to be served. This includes the time
193 spent by the requests in queue and the time spent servic‐
194 ing them.
195 svctm
197 The average service time (in milliseconds) for I/O
198 requests that were issued to the device.
199 %util
201 Percentage of CPU time during which I/O requests were
202 issued to the device (bandwidth utilization for the
203 device). Device saturation occurs when this value is
204 close to 100%.
205 -e [ hh:mm:ss ]
207 Set the ending time of the report. The default ending time is
208 18:00:00. Hours must be given in 24-hour format. This option
209 can be used when data are read from or written to a file
210 (options -f or -o ).
211 -f [ filename ]
213 Extract records from filename (created by the -o filename flag).
214 The default value of the filename parameter is the current daily
215 data file, the /var/log/sa/sadd file. The -f option is exclusive
216 of the -o option.
217 -h Display a short help message then exit.
219 -i interval
221 Select data records at seconds as close as possible to the num‐
222 ber specified by the interval parameter.
223 -I { int [,...] | SUM | ALL | XALL }
225 Report statistics for a given interrupt. int is the interrupt
226 number. Specifying multiple -I int parameters on the command
227 line will look at multiple independent interrupts. The SUM key‐
228 word indicates that the total number of interrupts received per
229 second is to be displayed. The ALL keyword indicates that sta‐
230 tistics from the first 16 interrupts are to be reported, whereas
231 the XALL keyword indicates that statistics from all interrupts,
232 including potential APIC interrupt sources, are to be reported.
233 Note that interrupt statistics depend on sadc option "-S INT" to
234 be collected.
235 -m Report power management statistics. Note that these statistics
237 depend on sadc option "-S POWER" to be collected. The following
238 value is displayed:
239 MHz
241 CPU clock frequency in MHz.
242 -n { keyword [,...] | ALL }
244 Report network statistics.
245 Possible keywords are DEV, EDEV, NFS, NFSD, SOCK, IP, EIP, ICMP,
247 EICMP, TCP, ETCP, UDP, SOCK6, IP6, EIP6, ICMP6, EICMP6 and UDP6.
248 With the DEV keyword, statistics from the network devices are
250 reported. The following values are displayed:
251 IFACE
253 Name of the network interface for which statistics are
254 reported.
255 rxpck/s
257 Total number of packets received per second.
258 txpck/s
260 Total number of packets transmitted per second.
261 rxkB/s
263 Total number of kilobytes received per second.
264 txkB/s
266 Total number of kilobytes transmitted per second.
267 rxcmp/s
269 Number of compressed packets received per second (for
270 cslip etc.).
271 txcmp/s
273 Number of compressed packets transmitted per second.
274 rxmcst/s
276 Number of multicast packets received per second.
277 With the EDEV keyword, statistics on failures (errors) from the
279 network devices are reported. The following values are dis‐
280 played:
281 IFACE
283 Name of the network interface for which statistics are
284 reported.
285 rxerr/s
287 Total number of bad packets received per second.
288 txerr/s
290 Total number of errors that happened per second while
291 transmitting packets.
292 coll/s
294 Number of collisions that happened per second while
295 transmitting packets.
296 rxdrop/s
298 Number of received packets dropped per second because of
299 a lack of space in linux buffers.
300 txdrop/s
302 Number of transmitted packets dropped per second because
303 of a lack of space in linux buffers.
304 txcarr/s
306 Number of carrier-errors that happened per second while
307 transmitting packets.
308 rxfram/s
310 Number of frame alignment errors that happened per second
311 on received packets.
312 rxfifo/s
314 Number of FIFO overrun errors that happened per second on
315 received packets.
316 txfifo/s
318 Number of FIFO overrun errors that happened per second on
319 transmitted packets.
320 With the NFS keyword, statistics about NFS client activity are
322 reported. The following values are displayed:
323 call/s
325 Number of RPC requests made per second.
326 retrans/s
328 Number of RPC requests per second, those which needed to
329 be retransmitted (for example because of a server time‐
330 out).
331 read/s
333 Number of 'read' RPC calls made per second.
334 write/s
336 Number of 'write' RPC calls made per second.
337 access/s
339 Number of 'access' RPC calls made per second.
340 getatt/s
342 Number of 'getattr' RPC calls made per second.
343 With the NFSD keyword, statistics about NFS server activity are
345 reported. The following values are displayed:
346 scall/s
348 Number of RPC requests received per second.
349 badcall/s
351 Number of bad RPC requests received per second, those
352 whose processing generated an error.
353 packet/s
355 Number of network packets received per second.
356 udp/s
358 Number of UDP packets received per second.
359 tcp/s
361 Number of TCP packets received per second.
362 hit/s
364 Number of reply cache hits per second.
365 miss/s
367 Number of reply cache misses per second.
368 sread/s
370 Number of 'read' RPC calls received per second.
371 swrite/s
373 Number of 'write' RPC calls received per second.
374 saccess/s
376 Number of 'access' RPC calls received per second.
377 sgetatt/s
379 Number of 'getattr' RPC calls received per second.
380 With the SOCK keyword, statistics on sockets in use are reported
382 (IPv4). The following values are displayed:
383 totsck
385 Total number of sockets used by the system.
386 tcpsck
388 Number of TCP sockets currently in use.
389 udpsck
391 Number of UDP sockets currently in use.
392 rawsck
394 Number of RAW sockets currently in use.
395 ip-frag
397 Number of IP fragments currently in use.
398 tcp-tw
400 Number of TCP sockets in TIME_WAIT state.
401 With the IP keyword, statistics about IPv4 network traffic are
403 reported. Note that IPv4 statistics depend on sadc option "-S
404 SNMP" to be collected. The following values are displayed (for‐
405 mal SNMP names between square brackets):
406 irec/s
408 The total number of input datagrams received from inter‐
409 faces per second, including those received in error
410 [ipInReceives].
411 fwddgm/s
413 The number of input datagrams per second, for which this
414 entity was not their final IP destination, as a result of
415 which an attempt was made to find a route to forward them
416 to that final destination [ipForwDatagrams].
417 idel/s
419 The total number of input datagrams successfully deliv‐
420 ered per second to IP user-protocols (including ICMP)
421 [ipInDelivers].
422 orq/s
424 The total number of IP datagrams which local IP user-pro‐
425 tocols (including ICMP) supplied per second to IP in
426 requests for transmission [ipOutRequests]. Note that
427 this counter does not include any datagrams counted in
428 fwddgm/s.
429 asmrq/s
431 The number of IP fragments received per second which
432 needed to be reassembled at this entity [ipReasmReqds].
433 asmok/s
435 The number of IP datagrams successfully re-assembled per
436 second [ipReasmOKs].
437 fragok/s
439 The number of IP datagrams that have been successfully
440 fragmented at this entity per second [ipFragOKs].
441 fragcrt/s
443 The number of IP datagram fragments that have been gener‐
444 ated per second as a result of fragmentation at this
445 entity [ipFragCreates].
446 With the EIP keyword, statistics about IPv4 network errors are
448 reported. Note that IPv4 statistics depend on sadc option "-S
449 SNMP" to be collected. The following values are displayed (for‐
450 mal SNMP names between square brackets):
451 ihdrerr/s
453 The number of input datagrams discarded per second due to
454 errors in their IP headers, including bad checksums, ver‐
455 sion number mismatch, other format errors, time-to-live
456 exceeded, errors discovered in processing their IP
457 options, etc. [ipInHdrErrors]
458 iadrerr/s
460 The number of input datagrams discarded per second
461 because the IP address in their IP header's destination
462 field was not a valid address to be received at this
463 entity. This count includes invalid addresses (e.g.,
464 0.0.0.0) and addresses of unsupported Classes (e.g.,
465 Class E). For entities which are not IP routers and
466 therefore do not forward datagrams, this counter includes
467 datagrams discarded because the destination address was
468 not a local address [ipInAddrErrors].
469 iukwnpr/s
471 The number of locally-addressed datagrams received suc‐
472 cessfully but discarded per second because of an unknown
473 or unsupported protocol [ipInUnknownProtos].
474 idisc/s
476 The number of input IP datagrams per second for which no
477 problems were encountered to prevent their continued pro‐
478 cessing, but which were discarded (e.g., for lack of buf‐
479 fer space) [ipInDiscards]. Note that this counter does
480 not include any datagrams discarded while awaiting re-
481 assembly.
482 odisc/s
484 The number of output IP datagrams per second for which no
485 problem was encountered to prevent their transmission to
486 their destination, but which were discarded (e.g., for
487 lack of buffer space) [ipOutDiscards]. Note that this
488 counter would include datagrams counted in fwddgm/s if
489 any such packets met this (discretionary) discard crite‐
490 rion.
491 onort/s
493 The number of IP datagrams discarded per second because
494 no route could be found to transmit them to their desti‐
495 nation [ipOutNoRoutes]. Note that this counter includes
496 any packets counted in fwddgm/s which meet this 'no-
497 route' criterion. Note that this includes any datagrams
498 which a host cannot route because all of its default
499 routers are down.
500 asmf/s
502 The number of failures detected per second by the IP re-
503 assembly algorithm (for whatever reason: timed out,
504 errors, etc) [ipReasmFails]. Note that this is not nec‐
505 essarily a count of discarded IP fragments since some
506 algorithms can lose track of the number of fragments by
507 combining them as they are received.
508 fragf/s
510 The number of IP datagrams that have been discarded per
511 second because they needed to be fragmented at this
512 entity but could not be, e.g., because their Don't Frag‐
513 ment flag was set [ipFragFails].
514 With the ICMP keyword, statistics about ICMPv4 network traffic
516 are reported. Note that ICMPv4 statistics depend on sadc option
517 "-S SNMP" to be collected. The following values are displayed
518 (formal SNMP names between square brackets):
519 imsg/s
521 The total number of ICMP messages which the entity
522 received per second [icmpInMsgs]. Note that this counter
523 includes all those counted by ierr/s.
524 omsg/s
526 The total number of ICMP messages which this entity
527 attempted to send per second [icmpOutMsgs]. Note that
528 this counter includes all those counted by oerr/s.
529 iech/s
531 The number of ICMP Echo (request) messages received per
532 second [icmpInEchos].
533 iechr/s
535 The number of ICMP Echo Reply messages received per sec‐
536 ond [icmpInEchoReps].
537 oech/s
539 The number of ICMP Echo (request) messages sent per sec‐
540 ond [icmpOutEchos].
541 oechr/s
543 The number of ICMP Echo Reply messages sent per second
544 [icmpOutEchoReps].
545 itm/s
547 The number of ICMP Timestamp (request) messages received
548 per second [icmpInTimestamps].
549 itmr/s
551 The number of ICMP Timestamp Reply messages received per
552 second [icmpInTimestampReps].
553 otm/s
555 The number of ICMP Timestamp (request) messages sent per
556 second [icmpOutTimestamps].
557 otmr/s
559 The number of ICMP Timestamp Reply messages sent per sec‐
560 ond [icmpOutTimestampReps].
561 iadrmk/s
563 The number of ICMP Address Mask Request messages received
564 per second [icmpInAddrMasks].
565 iadrmkr/s
567 The number of ICMP Address Mask Reply messages received
568 per second [icmpInAddrMaskReps].
569 oadrmk/s
571 The number of ICMP Address Mask Request messages sent per
572 second [icmpOutAddrMasks].
573 oadrmkr/s
575 The number of ICMP Address Mask Reply messages sent per
576 second [icmpOutAddrMaskReps].
577 With the EICMP keyword, statistics about ICMPv4 error messages
579 are reported. Note that ICMPv4 statistics depend on sadc option
580 "-S SNMP" to be collected. The following values are displayed
581 (formal SNMP names between square brackets):
582 ierr/s
584 The number of ICMP messages per second which the entity
585 received but determined as having ICMP-specific errors
586 (bad ICMP checksums, bad length, etc.) [icmpInErrors].
587 oerr/s
589 The number of ICMP messages per second which this entity
590 did not send due to problems discovered within ICMP such
591 as a lack of buffers [icmpOutErrors].
592 idstunr/s
594 The number of ICMP Destination Unreachable messages
595 received per second [icmpInDestUnreachs].
596 odstunr/s
598 The number of ICMP Destination Unreachable messages sent
599 per second [icmpOutDestUnreachs].
600 itmex/s
602 The number of ICMP Time Exceeded messages received per
603 second [icmpInTimeExcds].
604 otmex/s
606 The number of ICMP Time Exceeded messages sent per second
607 [icmpOutTimeExcds].
608 iparmpb/s
610 The number of ICMP Parameter Problem messages received
611 per second [icmpInParmProbs].
612 oparmpb/s
614 The number of ICMP Parameter Problem messages sent per
615 second [icmpOutParmProbs].
616 isrcq/s
618 The number of ICMP Source Quench messages received per
619 second [icmpInSrcQuenchs].
620 osrcq/s
622 The number of ICMP Source Quench messages sent per second
623 [icmpOutSrcQuenchs].
624 iredir/s
626 The number of ICMP Redirect messages received per second
627 [icmpInRedirects].
628 oredir/s
630 The number of ICMP Redirect messages sent per second
631 [icmpOutRedirects].
632 With the TCP keyword, statistics about TCPv4 network traffic are
634 reported. Note that TCPv4 statistics depend on sadc option "-S
635 SNMP" to be collected. The following values are displayed (for‐
636 mal SNMP names between square brackets):
637 active/s
639 The number of times TCP connections have made a direct
640 transition to the SYN-SENT state from the CLOSED state
641 per second [tcpActiveOpens].
642 passive/s
644 The number of times TCP connections have made a direct
645 transition to the SYN-RCVD state from the LISTEN state
646 per second [tcpPassiveOpens].
647 iseg/s
649 The total number of segments received per second, includ‐
650 ing those received in error [tcpInSegs]. This count
651 includes segments received on currently established con‐
652 nections.
653 oseg/s
655 The total number of segments sent per second, including
656 those on current connections but excluding those contain‐
657 ing only retransmitted octets [tcpOutSegs].
658 With the ETCP keyword, statistics about TCPv4 network errors are
660 reported. Note that TCPv4 statistics depend on sadc option "-S
661 SNMP" to be collected. The following values are displayed (for‐
662 mal SNMP names between square brackets):
663 atmptf/s
665 The number of times per second TCP connections have made
666 a direct transition to the CLOSED state from either the
667 SYN-SENT state or the SYN-RCVD state, plus the number of
668 times per second TCP connections have made a direct tran‐
669 sition to the LISTEN state from the SYN-RCVD state
670 [tcpAttemptFails].
671 estres/s
673 The number of times per second TCP connections have made
674 a direct transition to the CLOSED state from either the
675 ESTABLISHED state or the CLOSE-WAIT state [tcpEstabRe‐
676 sets].
677 retrans/s
679 The total number of segments retransmitted per second -
680 that is, the number of TCP segments transmitted contain‐
681 ing one or more previously transmitted octets [tcpRe‐
682 transSegs].
683 isegerr/s
685 The total number of segments received in error (e.g., bad
686 TCP checksums) per second [tcpInErrs].
687 orsts/s
689 The number of TCP segments sent per second containing the
690 RST flag [tcpOutRsts].
691 With the UDP keyword, statistics about UDPv4 network traffic are
693 reported. Note that UDPv4 statistics depend on sadc option "-S
694 SNMP" to be collected. The following values are displayed (for‐
695 mal SNMP names between square brackets):
696 idgm/s
698 The total number of UDP datagrams delivered per second to
699 UDP users [udpInDatagrams].
700 odgm/s
702 The total number of UDP datagrams sent per second from
703 this entity [udpOutDatagrams].
704 noport/s
706 The total number of received UDP datagrams per second for
707 which there was no application at the destination port
708 [udpNoPorts].
709 idgmerr/s
711 The number of received UDP datagrams per second that
712 could not be delivered for reasons other than the lack of
713 an application at the destination port [udpInErrors].
714 With the SOCK6 keyword, statistics on sockets in use are
716 reported (IPv6). Note that IPv6 statistics depend on sadc
717 option "-S IPV6" to be collected. The following values are dis‐
718 played:
719 tcp6sck
721 Number of TCPv6 sockets currently in use.
722 udp6sck
724 Number of UDPv6 sockets currently in use.
725 raw6sck
727 Number of RAWv6 sockets currently in use.
728 ip6-frag
730 Number of IPv6 fragments currently in use.
731 With the IP6 keyword, statistics about IPv6 network traffic are
733 reported. Note that IPv6 statistics depend on sadc option "-S
734 IPV6" to be collected. The following values are displayed (for‐
735 mal SNMP names between square brackets):
736 irec6/s
738 The total number of input datagrams received from inter‐
739 faces per second, including those received in error
740 [ipv6IfStatsInReceives].
741 fwddgm6/s
743 The number of output datagrams per second which this
744 entity received and forwarded to their final destinations
745 [ipv6IfStatsOutForwDatagrams].
746 idel6/s
748 The total number of datagrams successfully delivered per
749 second to IPv6 user-protocols (including ICMP) [ipv6IfS‐
750 tatsInDelivers].
751 orq6/s
753 The total number of IPv6 datagrams which local IPv6 user-
754 protocols (including ICMP) supplied per second to IPv6 in
755 requests for transmission [ipv6IfStatsOutRequests]. Note
756 that this counter does not include any datagrams counted
757 in fwddgm6/s.
758 asmrq6/s
760 The number of IPv6 fragments received per second which
761 needed to be reassembled at this interface [ipv6IfStat‐
762 sReasmReqds].
763 asmok6/s
765 The number of IPv6 datagrams successfully reassembled per
766 second [ipv6IfStatsReasmOKs].
767 imcpck6/s
769 The number of multicast packets received per second by
770 the interface [ipv6IfStatsInMcastPkts].
771 omcpck6/s
773 The number of multicast packets transmitted per second by
774 the interface [ipv6IfStatsOutMcastPkts].
775 fragok6/s
777 The number of IPv6 datagrams that have been successfully
778 fragmented at this output interface per second [ipv6IfS‐
779 tatsOutFragOKs].
780 fragcr6/s
782 The number of output datagram fragments that have been
783 generated per second as a result of fragmentation at this
784 output interface [ipv6IfStatsOutFragCreates].
785 With the EIP6 keyword, statistics about IPv6 network errors are
787 reported. Note that IPv6 statistics depend on sadc option "-S
788 IPV6" to be collected. The following values are displayed (for‐
789 mal SNMP names between square brackets):
790 ihdrer6/s
792 The number of input datagrams discarded per second due to
793 errors in their IPv6 headers, including version number
794 mismatch, other format errors, hop count exceeded, errors
795 discovered in processing their IPv6 options, etc.
796 [ipv6IfStatsInHdrErrors]
797 iadrer6/s
799 The number of input datagrams discarded per second
800 because the IPv6 address in their IPv6 header's destina‐
801 tion field was not a valid address to be received at this
802 entity. This count includes invalid addresses (e.g., ::0)
803 and unsupported addresses (e.g., addresses with unallo‐
804 cated prefixes). For entities which are not IPv6 routers
805 and therefore do not forward datagrams, this counter
806 includes datagrams discarded because the destination
807 address was not a local address [ipv6IfStatsInAddr‐
808 Errors].
809 iukwnp6/s
811 The number of locally-addressed datagrams received suc‐
812 cessfully but discarded per second because of an unknown
813 or unsupported protocol [ipv6IfStatsInUnknownProtos].
814 i2big6/s
816 The number of input datagrams that could not be forwarded
817 per second because their size exceeded the link MTU of
818 outgoing interface [ipv6IfStatsInTooBigErrors].
819 idisc6/s
821 The number of input IPv6 datagrams per second for which
822 no problems were encountered to prevent their continued
823 processing, but which were discarded (e.g., for lack of
824 buffer space) [ipv6IfStatsInDiscards]. Note that this
825 counter does not include any datagrams discarded while
826 awaiting re-assembly.
827 odisc6/s
829 The number of output IPv6 datagrams per second for which
830 no problem was encountered to prevent their transmission
831 to their destination, but which were discarded (e.g., for
832 lack of buffer space) [ipv6IfStatsOutDiscards]. Note that
833 this counter would include datagrams counted in fwddgm6/s
834 if any such packets met this (discretionary) discard cri‐
835 terion.
836 inort6/s
838 The number of input datagrams discarded per second
839 because no route could be found to transmit them to their
840 destination [ipv6IfStatsInNoRoutes].
841 onort6/s
843 The number of locally generated IP datagrams discarded
844 per second because no route could be found to transmit
845 them to their destination [unknown formal SNMP name].
846 asmf6/s
848 The number of failures detected per second by the IPv6
849 re-assembly algorithm (for whatever reason: timed out,
850 errors, etc.) [ipv6IfStatsReasmFails]. Note that this is
851 not necessarily a count of discarded IPv6 fragments since
852 some algorithms can lose track of the number of fragments
853 by combining them as they are received.
854 fragf6/s
856 The number of IPv6 datagrams that have been discarded per
857 second because they needed to be fragmented at this out‐
858 put interface but could not be [ipv6IfStatsOutFragFails].
859 itrpck6/s
861 The number of input datagrams discarded per second
862 because datagram frame didn't carry enough data [ipv6IfS‐
863 tatsInTruncatedPkts].
864 With the ICMP6 keyword, statistics about ICMPv6 network traffic
866 are reported. Note that ICMPv6 statistics depend on sadc option
867 "-S IPV6" to be collected. The following values are displayed
868 (formal SNMP names between square brackets):
869 imsg6/s
871 The total number of ICMP messages received by the inter‐
872 face per second which includes all those counted by
873 ierr6/s [ipv6IfIcmpInMsgs].
874 omsg6/s
876 The total number of ICMP messages which this interface
877 attempted to send per second [ipv6IfIcmpOutMsgs].
878 iech6/s
880 The number of ICMP Echo (request) messages received by
881 the interface per second [ipv6IfIcmpInEchos].
882 iechr6/s
884 The number of ICMP Echo Reply messages received by the
885 interface per second [ipv6IfIcmpInEchoReplies].
886 oechr6/s
888 The number of ICMP Echo Reply messages sent by the inter‐
889 face per second [ipv6IfIcmpOutEchoReplies].
890 igmbq6/s
892 The number of ICMPv6 Group Membership Query messages
893 received by the interface per second [ipv6IfIcmpInGroup‐
894 MembQueries].
895 igmbr6/s
897 The number of ICMPv6 Group Membership Response messages
898 received by the interface per second [ipv6IfIcmpInGroup‐
899 MembResponses].
900 ogmbr6/s
902 The number of ICMPv6 Group Membership Response messages
903 sent per second [ipv6IfIcmpOutGroupMembResponses].
904 igmbrd6/s
906 The number of ICMPv6 Group Membership Reduction messages
907 received by the interface per second [ipv6IfIcmpInGroup‐
908 MembReductions].
909 ogmbrd6/s
911 The number of ICMPv6 Group Membership Reduction messages
912 sent per second [ipv6IfIcmpOutGroupMembReductions].
913 irtsol6/s
915 The number of ICMP Router Solicit messages received by
916 the interface per second [ipv6IfIcmpInRouterSolicits].
917 ortsol6/s
919 The number of ICMP Router Solicitation messages sent by
920 the interface per second [ipv6IfIcmpOutRouterSolicits].
921 irtad6/s
923 The number of ICMP Router Advertisement messages received
924 by the interface per second [ipv6IfIcmpInRouterAdvertise‐
925 ments].
926 inbsol6/s
928 The number of ICMP Neighbor Solicit messages received by
929 the interface per second [ipv6IfIcmpInNeighborSolicits].
930 onbsol6/s
932 The number of ICMP Neighbor Solicitation messages sent by
933 the interface per second [ipv6IfIcmpOutNeighborSolicits].
934 inbad6/s
936 The number of ICMP Neighbor Advertisement messages
937 received by the interface per second [ipv6IfIcmpInNeighb‐
938 orAdvertisements].
939 onbad6/s
941 The number of ICMP Neighbor Advertisement messages sent
942 by the interface per second [ipv6IfIcmpOutNeighborAdver‐
943 tisements].
944 With the EICMP6 keyword, statistics about ICMPv6 error messages
946 are reported. Note that ICMPv6 statistics depend on sadc option
947 "-S IPV6" to be collected. The following values are displayed
948 (formal SNMP names between square brackets):
949 ierr6/s
951 The number of ICMP messages per second which the inter‐
952 face received but determined as having ICMP-specific
953 errors (bad ICMP checksums, bad length, etc.)
954 [ipv6IfIcmpInErrors]
955 idtunr6/s
957 The number of ICMP Destination Unreachable messages
958 received by the interface per second [ipv6IfIcmpInDestUn‐
959 reachs].
960 odtunr6/s
962 The number of ICMP Destination Unreachable messages sent
963 by the interface per second [ipv6IfIcmpOutDestUnreachs].
964 itmex6/s
966 The number of ICMP Time Exceeded messages received by the
967 interface per second [ipv6IfIcmpInTimeExcds].
968 otmex6/s
970 The number of ICMP Time Exceeded messages sent by the
971 interface per second [ipv6IfIcmpOutTimeExcds].
972 iprmpb6/s
974 The number of ICMP Parameter Problem messages received by
975 the interface per second [ipv6IfIcmpInParmProblems].
976 oprmpb6/s
978 The number of ICMP Parameter Problem messages sent by the
979 interface per second [ipv6IfIcmpOutParmProblems].
980 iredir6/s
982 The number of Redirect messages received by the interface
983 per second [ipv6IfIcmpInRedirects].
984 oredir6/s
986 The number of Redirect messages sent by the interface by
987 second [ipv6IfIcmpOutRedirects].
988 ipck2b6/s
990 The number of ICMP Packet Too Big messages received by
991 the interface per second [ipv6IfIcmpInPktTooBigs].
992 opck2b6/s
994 The number of ICMP Packet Too Big messages sent by the
995 interface per second [ipv6IfIcmpOutPktTooBigs].
996 With the UDP6 keyword, statistics about UDPv6 network traffic
998 are reported. Note that UDPv6 statistics depend on sadc option
999 "-S IPV6" to be collected. The following values are displayed
1000 (formal SNMP names between square brackets):
1001 idgm6/s
1003 The total number of UDP datagrams delivered per second to
1004 UDP users [udpInDatagrams].
1005 odgm6/s
1007 The total number of UDP datagrams sent per second from
1008 this entity [udpOutDatagrams].
1009 noport6/s
1011 The total number of received UDP datagrams per second for
1012 which there was no application at the destination port
1013 [udpNoPorts].
1014 idgmer6/s
1016 The number of received UDP datagrams per second that
1017 could not be delivered for reasons other than the lack of
1018 an application at the destination port [udpInErrors].
1019 The ALL keyword is equivalent to specifying all the keywords
1021 above and therefore all the network activities are reported.
1022 -o [ filename ]
1024 Save the readings in the file in binary form. Each reading is in
1025 a separate record. The default value of the filename parameter
1026 is the current daily data file, the /var/log/sa/sadd file. The
1027 -o option is exclusive of the -f option. All the data available
1028 from the kernel are saved in the file (in fact, sar calls its
1029 data collector sadc with the option "-S ALL". See sadc(8) manual
1030 page).
1031 -P { cpu [,...] | ALL }
1033 Report per-processor statistics for the specified processor or
1034 processors. Specifying the ALL keyword reports statistics for
1035 each individual processor, and globally for all processors.
1036 Note that processor 0 is the first processor.
1037 -p Pretty-print device names. Use this option in conjunction with
1039 option -d. By default names are printed as dev m-n where m and
1040 n are the major and minor numbers for the device. Use of this
1041 option displays the names of the devices as they (should) appear
1042 in /dev. Name mappings are controlled by /etc/sysconfig/sys‐
1043 stat.ioconf.
1044 -q Report queue length and load averages. The following values are
1046 displayed:
1047 runq-sz
1049 Run queue length (number of tasks waiting for run time).
1050 plist-sz
1052 Number of tasks in the task list.
1053 ldavg-1
1055 System load average for the last minute. The load aver‐
1056 age is calculated as the average number of runnable or
1057 running tasks (R state), and the number of tasks in unin‐
1058 terruptible sleep (D state) over the specified interval.
1059 ldavg-5
1061 System load average for the past 5 minutes.
1062 ldavg-15
1064 System load average for the past 15 minutes.
1065 -r Report memory utilization statistics. The following values are
1067 displayed:
1068 kbmemfree
1070 Amount of free memory available in kilobytes.
1071 kbmemused
1073 Amount of used memory in kilobytes. This does not take
1074 into account memory used by the kernel itself.
1075 %memused
1077 Percentage of used memory.
1078 kbbuffers
1080 Amount of memory used as buffers by the kernel in kilo‐
1081 bytes.
1082 kbcached
1084 Amount of memory used to cache data by the kernel in
1085 kilobytes.
1086 kbcommit
1088 Amount of memory in kilobytes needed for current work‐
1089 load. This is an estimate of how much RAM/swap is needed
1090 to guarantee that there never is out of memory.
1091 %commit
1093 Percentage of memory needed for current workload in rela‐
1094 tion to the total amount of memory (RAM+swap). This num‐
1095 ber may be greater than 100% because the kernel usually
1096 overcommits memory.
1097 -R Report memory statistics. The following values are displayed:
1100 frmpg/s
1102 Number of memory pages freed by the system per second. A
1103 negative value represents a number of pages allocated by
1104 the system. Note that a page has a size of 4 kB or 8 kB
1105 according to the machine architecture.
1106 bufpg/s
1108 Number of additional memory pages used as buffers by the
1109 system per second. A negative value means fewer pages
1110 used as buffers by the system.
1111 campg/s
1113 Number of additional memory pages cached by the system
1114 per second. A negative value means fewer pages in the
1115 cache.
1116 -s [ hh:mm:ss ]
1118 Set the starting time of the data, causing the sar command to
1119 extract records time-tagged at, or following, the time speci‐
1120 fied. The default starting time is 08:00:00. Hours must be
1121 given in 24-hour format. This option can be used only when data
1122 are read from a file (option -f ).
1123 -S Report swap space utilization statistics. The following values
1125 are displayed:
1126 kbswpfree
1128 Amount of free swap space in kilobytes.
1129 kbswpused
1131 Amount of used swap space in kilobytes.
1132 %swpused
1134 Percentage of used swap space.
1135 kbswpcad
1137 Amount of cached swap memory in kilobytes. This is mem‐
1138 ory that once was swapped out, is swapped back in but
1139 still also is in the swap area (if memory is needed it
1140 doesn't need to be swapped out again because it is
1141 already in the swap area. This saves I/O).
1142 %swpcad
1144 Percentage of cached swap memory in relation to the
1145 amount of used swap space.
1146 -t When reading data from a daily data file, indicate that sar
1148 should display the timestamps in the original locale time of the
1149 data file creator. Without this option, the sar command displays
1150 the timestamps in the user's locale time.
1151 -u [ ALL ]
1153 Report CPU utilization. The ALL keyword indicates that all the
1154 CPU fields should be displayed. The report may show the follow‐
1155 ing fields:
1156 %user
1158 Percentage of CPU utilization that occurred while execut‐
1159 ing at the user level (application). Note that this field
1160 includes time spent running virtual processors.
1161 %usr
1163 Percentage of CPU utilization that occurred while execut‐
1164 ing at the user level (application). Note that this field
1165 does NOT include time spent running virtual processors.
1166 %nice
1168 Percentage of CPU utilization that occurred while execut‐
1169 ing at the user level with nice priority.
1170 %system
1172 Percentage of CPU utilization that occurred while execut‐
1173 ing at the system level (kernel). Note that this field
1174 includes time spent servicing hardware and software
1175 interrupts.
1176 %sys
1178 Percentage of CPU utilization that occurred while execut‐
1179 ing at the system level (kernel). Note that this field
1180 does NOT include time spent servicing hardware or soft‐
1181 ware interrupts.
1182 %iowait
1184 Percentage of time that the CPU or CPUs were idle during
1185 which the system had an outstanding disk I/O request.
1186 %steal
1188 Percentage of time spent in involuntary wait by the vir‐
1189 tual CPU or CPUs while the hypervisor was servicing
1190 another virtual processor.
1191 %irq
1193 Percentage of time spent by the CPU or CPUs to service
1194 hardware interrupts.
1195 %soft
1197 Percentage of time spent by the CPU or CPUs to service
1198 software interrupts.
1199 %guest
1201 Percentage of time spent by the CPU or CPUs to run a vir‐
1202 tual processor.
1203 %idle
1205 Percentage of time that the CPU or CPUs were idle and the
1206 system did not have an outstanding disk I/O request.
1207 Note: On SMP machines a processor that does not have any activ‐
1209 ity at all (0.00 for every field) is a disabled (offline) pro‐
1210 cessor.
1211 -v Report status of inode, file and other kernel tables. The fol‐
1213 lowing values are displayed:
1214 dentunusd
1216 Number of unused cache entries in the directory cache.
1217 file-nr
1219 Number of file handles used by the system.
1220 inode-nr
1222 Number of inode handlers used by the system.
1223 pty-nr
1225 Number of pseudo-terminals used by the system.
1226 -V Print version number then exit.
1228 -w Report task creation and system switching activity.
1230 proc/s
1232 Total number of tasks created per second.
1233 cswch/s
1235 Total number of context switches per second.
1236 -W Report swapping statistics. The following values are displayed:
1238 pswpin/s
1240 Total number of swap pages the system brought in per sec‐
1241 ond.
1242 pswpout/s
1244 Total number of swap pages the system brought out per
1245 second.
1246 -y Report TTY device activity. The following values are displayed:
1248 rcvin/s
1250 Number of receive interrupts per second for current
1251 serial line. Serial line number is given in the TTY col‐
1252 umn.
1253 xmtin/s
1255 Number of transmit interrupts per second for current
1256 serial line.
1257 framerr/s
1259 Number of frame errors per second for current serial
1260 line.
1261 prtyerr/s
1263 Number of parity errors per second for current serial
1264 line.
1265 brk/s
1267 Number of breaks per second for current serial line.
1268 ovrun/s
1270 Number of overrun errors per second for current serial
1271 line.
1272 Note that with recent 2.6 kernels, these statistics can be
1274 retrieved only by root.
1275
1278 The sar command takes into account the following environment variables:
1279 S_TIME_FORMAT
1282 If this variable exists and its value is ISO then the current
1283 locale will be ignored when printing the date in the report
1284 header. The sar command will use the ISO 8601 format (YYYY-MM-
1285 DD) instead.
1286 S_TIME_DEF_TIME
1289 If this variable exists and its value is UTC then sar will save
1290 its data in UTC time (data will still be displayed in local
1291 time). sar will also use UTC time instead of local time to
1292 determine the current daily data file located in the /var/log/sa
1293 directory. This variable may be useful for servers with users
1294 located across several timezones.
1295
1297 sar -u 2 5
1298 Report CPU utilization for each 2 seconds. 5 lines are dis‐
1299 played.
1300 sar -I 14 -o int14.file 2 10
1302 Report statistics on IRQ 14 for each 2 seconds. 10 lines are
1303 displayed. Data are stored in a file called int14.file.
1304 sar -r -n DEV -f /var/log/sa/sa16
1306 Display memory and network statistics saved in daily data file
1307 'sa16'.
1308 sar -A
1310 Display all the statistics saved in current daily data file.
1311
1313 /proc filesystem must be mounted for the sar command to work.
1314 All the statistics are not necessarily available, depending on the ker‐
1316 nel version used.
1317
1319 /var/log/sa/sadd
1320 Indicate the daily data file, where the dd parameter is a number
1321 representing the day of the month.
1322 /proc contains various files with system statistics.
1324
1326 Sebastien Godard (sysstat <at> orange.fr)
1327
1329 sadc(8), sa1(8), sa2(8), sadf(1), isag(1), pidstat(1), mpstat(1),
1330 iostat(1), vmstat(8)
1331 http://pagesperso-orange.fr/sebastien.godard/
1333Linux MAY 2009 SAR(1)