1SAR(1) Linux User's Manual SAR(1)
2
6 sar - Collect, report, or save system activity information.
7
10 sar [ -A ] [ -B ] [ -b ] [ -C ] [ -D ] [ -d ] [ -F [ MOUNT ] ] [ -H ] [
11 -h ] [ -p ] [ -r [ ALL ] ] [ -S ] [ -t ] [ -u [ ALL ] ] [ -V ] [ -v ] [
12 -W ] [ -w ] [ -y ] [ -z ] [ --dec={ 0 | 1 | 2 } ] [ --dev=dev_list ] [
13 --fs=fs_list ] [ --help ] [ --human ] [ --iface=iface_list ] [
14 --int=int_list ] [ --pretty ] [ --sadc ] [ -I [ SUM | ALL ] ] [ -P {
15 cpu_list | ALL } ] [ -m { keyword[,...] | ALL } ] [ -n { keyword[,...]
16 | ALL } ] [ -q [ keyword[,...] | ALL ] ] [ -j { SID | ID | LABEL | PATH
17 | UUID | ... } ] [ -f [ filename ] | -o [ filename ] | -[0-9]+ ] [ -i
18 interval ] [ -s [ hh:mm[:ss] ] ] [ -e [ hh:mm[:ss] ] ] [ interval [
19 count ] ]
20
23 The sar command writes to standard output the contents of selected cu‐
24 mulative activity counters in the operating system. The accounting sys‐
25 tem, based on the values in the count and interval parameters, writes
26 information the specified number of times spaced at the specified in‐
27 tervals in seconds. If the interval parameter is set to zero, the sar
28 command displays the average statistics for the time since the system
29 was started. If the interval parameter is specified without the count
30 parameter, then reports are generated continuously. The collected data
31 can also be saved in the file specified by the -o filename flag, in ad‐
32 dition to being displayed onto the screen. If filename is omitted, sar
33 uses the standard system activity daily data file (see below). By de‐
34 fault all the data available from the kernel are saved in the data
35 file.
36 The sar command extracts and writes to standard output records previ‐
38 ously saved in a file. This file can be either the one specified by the
39 -f flag or, by default, the standard system activity daily data file.
40 It is also possible to enter -1, -2 etc. as an argument to sar to dis‐
41 play data of that days ago. For example, -1 will point at the standard
42 system activity file of yesterday.
43 Standard system activity daily data files are named saDD or saYYYYMMDD,
45 where YYYY stands for the current year, MM for the current month and DD
46 for the current day. They are the default files used by sar only when
47 no filename has been explicitly specified. When used to write data to
48 files (with its option -o), sar will use saYYYYMMDD if option -D has
49 also been specified, else it will use saDD. When used to display the
50 records previously saved in a file, sar will look for the most recent
51 of saDD and saYYYYMMDD, and use it.
52 Standard system activity daily data files are located in the
54 /var/log/sa directory by default. Yet it is possible to specify an al‐
55 ternate location for them: If a directory (instead of a plain file) is
56 used with options -f or -o then it will be considered as the directory
57 containing the data files.
58 Without the -P flag, the sar command reports system-wide (global among
60 all processors) statistics, which are calculated as averages for values
61 expressed as percentages, and as sums otherwise. If the -P flag is
62 given, the sar command reports activity which relates to the specified
63 processor or processors. If -P ALL is given, the sar command reports
64 statistics for each individual processor and global statistics among
65 all processors. Offline processors are not displayed.
66 You can select information about specific system activities using
68 flags. Not specifying any flags selects only CPU activity. Specifying
69 the -A flag selects all possible activities.
70 The default version of the sar command (CPU utilization report) might
72 be one of the first facilities the user runs to begin system activity
73 investigation, because it monitors major system resources. If CPU uti‐
74 lization is near 100 percent (user + nice + system), the workload sam‐
75 pled is CPU-bound.
76 If multiple samples and multiple reports are desired, it is convenient
78 to specify an output file for the sar command. Run the sar command as a
79 background process. The syntax for this is:
80 sar -o datafile interval count >/dev/null 2>&1 &
82 All data are captured in binary form and saved to a file (datafile).
84 The data can then be selectively displayed with the sar command using
85 the -f option. Set the interval and count parameters to select count
86 records at interval second intervals. If the count parameter is not
87 set, all the records saved in the file will be selected. Collection of
88 data in this manner is useful to characterize system usage over a pe‐
89 riod of time and determine peak usage hours.
90 Note: The sar command only reports on local activities.
92
95 -A This is equivalent to specifying -bBdFHISvwWy -m ALL -n ALL -q
96 ALL -r ALL -u ALL. This option also implies specifying -I ALL
97 -P ALL unless these options are explicitly set on the command
98 line.
99 -B Report paging statistics. The following values are displayed:
101 pgpgin/s
103 Total number of kilobytes the system paged in from disk
104 per second.
105 pgpgout/s
107 Total number of kilobytes the system paged out to disk
108 per second.
109 fault/s
111 Number of page faults (major + minor) made by the system
112 per second. This is not a count of page faults that gen‐
113 erate I/O, because some page faults can be resolved with‐
114 out I/O.
115 majflt/s
117 Number of major faults the system has made per second,
118 those which have required loading a memory page from
119 disk.
120 pgfree/s
122 Number of pages placed on the free list by the system per
123 second.
124 pgscank/s
126 Number of pages scanned by the kswapd daemon per second.
127 pgscand/s
129 Number of pages scanned directly per second.
130 pgsteal/s
132 Number of pages the system has reclaimed from cache
133 (pagecache and swapcache) per second to satisfy its mem‐
134 ory demands.
135 %vmeff Calculated as pgsteal / pgscan, this is a metric of the
137 efficiency of page reclaim. If it is near 100% then al‐
138 most every page coming off the tail of the inactive list
139 is being reaped. If it gets too low (e.g. less than 30%)
140 then the virtual memory is having some difficulty. This
141 field is displayed as zero if no pages have been scanned
142 during the interval of time.
143 -b Report I/O and transfer rate statistics. The following values
145 are displayed:
146 tps Total number of transfers per second that were issued to
148 physical devices. A transfer is an I/O request to a
149 physical device. Multiple logical requests can be com‐
150 bined into a single I/O request to the device. A trans‐
151 fer is of indeterminate size.
152 rtps Total number of read requests per second issued to physi‐
154 cal devices.
155 wtps Total number of write requests per second issued to phys‐
157 ical devices.
158 dtps Total number of discard requests per second issued to
160 physical devices.
161 bread/s
163 Total amount of data read from the devices in blocks per
164 second. Blocks are equivalent to sectors and therefore
165 have a size of 512 bytes.
166 bwrtn/s
168 Total amount of data written to devices in blocks per
169 second.
170 bdscd/s
172 Total amount of data discarded for devices in blocks per
173 second.
174 -C When reading data from a file, tell sar to display comments that
176 have been inserted by sadc.
177 -D Use saYYYYMMDD instead of saDD as the standard system activity
179 daily data file name. This option works only when used in con‐
180 junction with option -o to save data to file.
181 -d Report activity for each block device. When data are displayed,
183 the device name is displayed as it (should) appear in /dev. sar
184 uses data in /sys to determine the device name based on its ma‐
185 jor and minor numbers. If this name resolution fails, sar will
186 use name mapping controlled by /etc/sysconfig/sysstat.ioconf
187 file. Persistent device names can also be printed if option -j
188 is used (see below). Statistics for all devices are displayed
189 unless a restricted list is specified using option --dev= (see
190 corresponding option entry). Note that disk activity depends on
191 sadc's options -S DISK and -S XDISK to be collected. The follow‐
192 ing values are displayed:
193 tps Total number of transfers per second that were issued to
195 physical devices. A transfer is an I/O request to a
196 physical device. Multiple logical requests can be com‐
197 bined into a single I/O request to the device. A trans‐
198 fer is of indeterminate size.
199 rkB/s Number of kilobytes read from the device per second.
201 wkB/s Number of kilobytes written to the device per second.
203 dkB/s Number of kilobytes discarded for the device per second.
205 areq-sz
207 The average size (in kilobytes) of the I/O requests that
208 were issued to the device.
209 Note: In previous versions, this field was known as av‐
210 grq-sz and was expressed in sectors.
211 aqu-sz The average queue length of the requests that were issued
213 to the device.
214 Note: In previous versions, this field was known as
215 avgqu-sz.
216 await The average time (in milliseconds) for I/O requests is‐
218 sued to the device to be served. This includes the time
219 spent by the requests in queue and the time spent servic‐
220 ing them.
221 %util Percentage of elapsed time during which I/O requests were
223 issued to the device (bandwidth utilization for the de‐
224 vice). Device saturation occurs when this value is close
225 to 100% for devices serving requests serially. But for
226 devices serving requests in parallel, such as RAID arrays
227 and modern SSDs, this number does not reflect their per‐
228 formance limits.
229 --dec={ 0 | 1 | 2 }
231 Specify the number of decimal places to use (0 to 2, default
232 value is 2).
233 --dev=dev_list
235 Specify the block devices for which statistics are to be dis‐
236 played by sar. dev_list is a list of comma-separated device
237 names.
238 -e [ hh:mm[:ss] ]
240 Set the ending time of the report. The default ending time is
241 18:00:00. Hours must be given in 24-hour format. This option
242 can be used when data are read from or written to a file (op‐
243 tions -f or -o).
244 -F [ MOUNT ]
246 Display statistics for currently mounted filesystems. Pseudo-
247 filesystems are ignored. At the end of the report, sar will dis‐
248 play a summary of all those filesystems. Use of the MOUNT param‐
249 eter keyword indicates that mountpoint will be reported instead
250 of filesystem device. Statistics for all filesystems are dis‐
251 played unless a restricted list is specified using option --fs=
252 (see corresponding option entry). Note that filesystems statis‐
253 tics depend on sadc's option -S XDISK to be collected.
254 The following values are displayed:
256 MBfsfree
258 Total amount of free space in megabytes (including space
259 available only to privileged user).
260 MBfsused
262 Total amount of space used in megabytes.
263 %fsused
265 Percentage of filesystem space used, as seen by a privi‐
266 leged user.
267 %ufsused
269 Percentage of filesystem space used, as seen by an un‐
270 privileged user.
271 Ifree Total number of free file nodes in filesystem.
273 Iused Total number of file nodes used in filesystem.
275 %Iused Percentage of file nodes used in filesystem.
277 -f [ filename ]
279 Extract records from filename (created by the -o filename flag).
280 The default value of the filename parameter is the current stan‐
281 dard system activity daily data file. If filename is a directory
282 instead of a plain file then it is considered as the directory
283 where the standard system activity daily data files are located.
284 Option -f is exclusive of option -o.
285 --fs=fs_list
287 Specify the filesystems for which statistics are to be displayed
288 by sar. fs_list is a list of comma-separated filesystem names
289 or mountpoints.
290 -H Report hugepages utilization statistics. The following values
292 are displayed:
293 kbhugfree
295 Amount of hugepages memory in kilobytes that is not yet
296 allocated.
297 kbhugused
299 Amount of hugepages memory in kilobytes that has been al‐
300 located.
301 %hugused
303 Percentage of total hugepages memory that has been allo‐
304 cated.
305 kbhugrsvd
307 Amount of reserved hugepages memory in kilobytes.
308 kbhugsurp
310 Amount of surplus hugepages memory in kilobytes.
311 -h This option is equivalent to specifying --pretty --human.
313 --help Display a short help message then exit.
315 --human
317 Print sizes in human readable format (e.g. 1.0k, 1.2M, etc.)
318 The units displayed with this option supersede any other default
319 units (e.g. kilobytes, sectors...) associated with the metrics.
320 -I [ SUM | ALL ]
322 Report statistics for interrupts. The values displayed are the
323 number of interrupts per second for the given processor or among
324 all processors. A list of interrupts can be specified using
325 --int= (see this option). The SUM keyword indicates that the to‐
326 tal number of interrupts received per second is to be displayed.
327 The ALL keyword indicates that statistics from all interrupts
328 are to be reported (this is the default). Note that interrupts
329 statistics depend on sadc's option -S INT to be collected.
330 -i interval
332 Select data records at seconds as close as possible to the num‐
333 ber specified by the interval parameter.
334 --iface=iface_list
336 Specify the network interfaces for which statistics are to be
337 displayed by sar. iface_list is a list of comma-separated in‐
338 terface names.
339 --int=int_list
341 Specify the interrupts names for which statistics are to be dis‐
342 played by sar. int_list is a list of comma-separated values or
343 range of values (e.g., 0-16,35,40-).
344 -j { SID | ID | LABEL | PATH | UUID | ... }
346 Display persistent device names. Use this option in conjunction
347 with option -d. Keywords ID, LABEL, etc. specify the type of the
348 persistent name. These keywords are not limited, only prerequi‐
349 site is that directory with required persistent names is present
350 in /dev/disk. Keyword SID tries to get a stable identifier to
351 use as the device name. A stable identifier won't change across
352 reboots for the same physical device. If it exists, this identi‐
353 fier is normally the WWN (World Wide Name) of the device, as
354 read from the /dev/disk/by-id directory.
355 -m { keyword[,...] | ALL }
357 Report power management statistics. Note that these statistics
358 depend on sadc's option -S POWER to be collected.
359 Possible keywords are CPU, FAN, FREQ, IN, TEMP and USB.
361 With the CPU keyword, statistics about CPU are reported. The
363 following value is displayed:
364 MHz Instantaneous CPU clock frequency in MHz.
366 With the FAN keyword, statistics about fans speed are reported.
369 The following values are displayed:
370 rpm Fan speed expressed in revolutions per minute.
372 drpm This field is calculated as the difference between cur‐
374 rent fan speed (rpm) and its low limit (fan_min).
375 DEVICE Sensor device name.
377 With the FREQ keyword, statistics about CPU clock frequency are
380 reported. The following value is displayed:
381 wghMHz Weighted average CPU clock frequency in MHz. Note that
383 the cpufreq-stats driver must be compiled in the kernel
384 for this option to work.
385 With the IN keyword, statistics about voltage inputs are re‐
388 ported. The following values are displayed:
389 inV Voltage input expressed in Volts.
391 %in Relative input value. A value of 100% means that voltage
393 input has reached its high limit (in_max) whereas a value
394 of 0% means that it has reached its low limit (in_min).
395 DEVICE Sensor device name.
397 With the TEMP keyword, statistics about devices temperature are
400 reported. The following values are displayed:
401 degC Device temperature expressed in degrees Celsius.
403 %temp Relative device temperature. A value of 100% means that
405 temperature has reached its high limit (temp_max).
406 DEVICE Sensor device name.
408 With the USB keyword, the sar command takes a snapshot of all
411 the USB devices currently plugged into the system. At the end of
412 the report, sar will display a summary of all those USB devices.
413 The following values are displayed:
414 BUS Root hub number of the USB device.
416 idvendor
418 Vendor ID number (assigned by USB organization).
419 idprod Product ID number (assigned by Manufacturer).
421 maxpower
423 Maximum power consumption of the device (expressed in
424 mA).
425 manufact
427 Manufacturer name.
428 product
430 Product name.
431 The ALL keyword is equivalent to specifying all the keywords
434 above and therefore all the power management statistics are re‐
435 ported.
436 -n { keyword[,...] | ALL }
438 Report network statistics.
439 Possible keywords are DEV, EDEV, FC, ICMP, EICMP, ICMP6, EICMP6,
441 IP, EIP, IP6, EIP6, NFS, NFSD, SOCK, SOCK6, SOFT, TCP, ETCP, UDP
442 and UDP6.
443 With the DEV keyword, statistics from the network devices are
445 reported. Statistics for all network interfaces are displayed
446 unless a restricted list is specified using option --iface= (see
447 corresponding option entry). The following values are dis‐
448 played:
449 IFACE Name of the network interface for which statistics are
451 reported.
452 rxpck/s
454 Total number of packets received per second.
455 txpck/s
457 Total number of packets transmitted per second.
458 rxkB/s Total number of kilobytes received per second.
460 txkB/s Total number of kilobytes transmitted per second.
462 rxcmp/s
464 Number of compressed packets received per second (for
465 cslip etc.).
466 txcmp/s
468 Number of compressed packets transmitted per second.
469 rxmcst/s
471 Number of multicast packets received per second.
472 %ifutil
474 Utilization percentage of the network interface. For
475 half-duplex interfaces, utilization is calculated using
476 the sum of rxkB/s and txkB/s as a percentage of the in‐
477 terface speed. For full-duplex, this is the greater of
478 rxkB/S or txkB/s.
479 With the EDEV keyword, statistics on failures (errors) from the
482 network devices are reported. Statistics for all network inter‐
483 faces are displayed unless a restricted list is specified using
484 option --iface= (see corresponding option entry). The following
485 values are displayed:
486 IFACE Name of the network interface for which statistics are
488 reported.
489 rxerr/s
491 Total number of bad packets received per second.
492 txerr/s
494 Total number of errors that happened per second while
495 transmitting packets.
496 coll/s Number of collisions that happened per second while
498 transmitting packets.
499 rxdrop/s
501 Number of received packets dropped per second because of
502 a lack of space in linux buffers.
503 txdrop/s
505 Number of transmitted packets dropped per second because
506 of a lack of space in linux buffers.
507 txcarr/s
509 Number of carrier-errors that happened per second while
510 transmitting packets.
511 rxfram/s
513 Number of frame alignment errors that happened per second
514 on received packets.
515 rxfifo/s
517 Number of FIFO overrun errors that happened per second on
518 received packets.
519 txfifo/s
521 Number of FIFO overrun errors that happened per second on
522 transmitted packets.
523 With the FC keyword, statistics about fibre channel traffic are
526 reported. Note that fibre channel statistics depend on sadc's
527 option -S DISK to be collected. The following values are dis‐
528 played:
529 FCHOST Name of the fibre channel host bus adapter (HBA) inter‐
531 face for which statistics are reported.
532 fch_rxf/s
534 The total number of frames received per second.
535 fch_txf/s
537 The total number of frames transmitted per second.
538 fch_rxw/s
540 The total number of transmission words received per sec‐
541 ond.
542 fch_txw/s
544 The total number of transmission words transmitted per
545 second.
546 With the ICMP keyword, statistics about ICMPv4 network traffic
549 are reported. Note that ICMPv4 statistics depend on sadc's op‐
550 tion -S SNMP to be collected. The following values are dis‐
551 played (formal SNMP names between square brackets):
552 imsg/s The total number of ICMP messages which the entity re‐
554 ceived per second [icmpInMsgs]. Note that this counter
555 includes all those counted by ierr/s.
556 omsg/s The total number of ICMP messages which this entity at‐
558 tempted to send per second [icmpOutMsgs]. Note that this
559 counter includes all those counted by oerr/s.
560 iech/s The number of ICMP Echo (request) messages received per
562 second [icmpInEchos].
563 iechr/s
565 The number of ICMP Echo Reply messages received per sec‐
566 ond [icmpInEchoReps].
567 oech/s The number of ICMP Echo (request) messages sent per sec‐
569 ond [icmpOutEchos].
570 oechr/s
572 The number of ICMP Echo Reply messages sent per second
573 [icmpOutEchoReps].
574 itm/s The number of ICMP Timestamp (request) messages received
576 per second [icmpInTimestamps].
577 itmr/s The number of ICMP Timestamp Reply messages received per
579 second [icmpInTimestampReps].
580 otm/s The number of ICMP Timestamp (request) messages sent per
582 second [icmpOutTimestamps].
583 otmr/s The number of ICMP Timestamp Reply messages sent per sec‐
585 ond [icmpOutTimestampReps].
586 iadrmk/s
588 The number of ICMP Address Mask Request messages received
589 per second [icmpInAddrMasks].
590 iadrmkr/s
592 The number of ICMP Address Mask Reply messages received
593 per second [icmpInAddrMaskReps].
594 oadrmk/s
596 The number of ICMP Address Mask Request messages sent per
597 second [icmpOutAddrMasks].
598 oadrmkr/s
600 The number of ICMP Address Mask Reply messages sent per
601 second [icmpOutAddrMaskReps].
602 With the EICMP keyword, statistics about ICMPv4 error messages
605 are reported. Note that ICMPv4 statistics depend on sadc's op‐
606 tion -S SNMP to be collected. The following values are dis‐
607 played (formal SNMP names between square brackets):
608 ierr/s The number of ICMP messages per second which the entity
610 received but determined as having ICMP-specific errors
611 (bad ICMP checksums, bad length, etc.) [icmpInErrors].
612 oerr/s The number of ICMP messages per second which this entity
614 did not send due to problems discovered within ICMP such
615 as a lack of buffers [icmpOutErrors].
616 idstunr/s
618 The number of ICMP Destination Unreachable messages re‐
619 ceived per second [icmpInDestUnreachs].
620 odstunr/s
622 The number of ICMP Destination Unreachable messages sent
623 per second [icmpOutDestUnreachs].
624 itmex/s
626 The number of ICMP Time Exceeded messages received per
627 second [icmpInTimeExcds].
628 otmex/s
630 The number of ICMP Time Exceeded messages sent per second
631 [icmpOutTimeExcds].
632 iparmpb/s
634 The number of ICMP Parameter Problem messages received
635 per second [icmpInParmProbs].
636 oparmpb/s
638 The number of ICMP Parameter Problem messages sent per
639 second [icmpOutParmProbs].
640 isrcq/s
642 The number of ICMP Source Quench messages received per
643 second [icmpInSrcQuenchs].
644 osrcq/s
646 The number of ICMP Source Quench messages sent per second
647 [icmpOutSrcQuenchs].
648 iredir/s
650 The number of ICMP Redirect messages received per second
651 [icmpInRedirects].
652 oredir/s
654 The number of ICMP Redirect messages sent per second
655 [icmpOutRedirects].
656 With the ICMP6 keyword, statistics about ICMPv6 network traffic
659 are reported. Note that ICMPv6 statistics depend on sadc's op‐
660 tion -S IPV6 to be collected. The following values are dis‐
661 played (formal SNMP names between square brackets):
662 imsg6/s
664 The total number of ICMP messages received by the inter‐
665 face per second which includes all those counted by
666 ierr6/s [ipv6IfIcmpInMsgs].
667 omsg6/s
669 The total number of ICMP messages which this interface
670 attempted to send per second [ipv6IfIcmpOutMsgs].
671 iech6/s
673 The number of ICMP Echo (request) messages received by
674 the interface per second [ipv6IfIcmpInEchos].
675 iechr6/s
677 The number of ICMP Echo Reply messages received by the
678 interface per second [ipv6IfIcmpInEchoReplies].
679 oechr6/s
681 The number of ICMP Echo Reply messages sent by the inter‐
682 face per second [ipv6IfIcmpOutEchoReplies].
683 igmbq6/s
685 The number of ICMPv6 Group Membership Query messages re‐
686 ceived by the interface per second [ipv6IfIcmpInGroupMem‐
687 bQueries].
688 igmbr6/s
690 The number of ICMPv6 Group Membership Response messages
691 received by the interface per second [ipv6IfIcmpInGroup‐
692 MembResponses].
693 ogmbr6/s
695 The number of ICMPv6 Group Membership Response messages
696 sent per second [ipv6IfIcmpOutGroupMembResponses].
697 igmbrd6/s
699 The number of ICMPv6 Group Membership Reduction messages
700 received by the interface per second [ipv6IfIcmpInGroup‐
701 MembReductions].
702 ogmbrd6/s
704 The number of ICMPv6 Group Membership Reduction messages
705 sent per second [ipv6IfIcmpOutGroupMembReductions].
706 irtsol6/s
708 The number of ICMP Router Solicit messages received by
709 the interface per second [ipv6IfIcmpInRouterSolicits].
710 ortsol6/s
712 The number of ICMP Router Solicitation messages sent by
713 the interface per second [ipv6IfIcmpOutRouterSolicits].
714 irtad6/s
716 The number of ICMP Router Advertisement messages received
717 by the interface per second [ipv6IfIcmpInRouterAdvertise‐
718 ments].
719 inbsol6/s
721 The number of ICMP Neighbor Solicit messages received by
722 the interface per second [ipv6IfIcmpInNeighborSolicits].
723 onbsol6/s
725 The number of ICMP Neighbor Solicitation messages sent by
726 the interface per second [ipv6IfIcmpOutNeighborSolicits].
727 inbad6/s
729 The number of ICMP Neighbor Advertisement messages re‐
730 ceived by the interface per second [ipv6IfIcmpInNeighbo‐
731 rAdvertisements].
732 onbad6/s
734 The number of ICMP Neighbor Advertisement messages sent
735 by the interface per second [ipv6IfIcmpOutNeighborAdver‐
736 tisements].
737 With the EICMP6 keyword, statistics about ICMPv6 error messages
740 are reported. Note that ICMPv6 statistics depend on sadc's op‐
741 tion -S IPV6 to be collected. The following values are dis‐
742 played (formal SNMP names between square brackets):
743 ierr6/s
745 The number of ICMP messages per second which the inter‐
746 face received but determined as having ICMP-specific er‐
747 rors (bad ICMP checksums, bad length, etc.)
748 [ipv6IfIcmpInErrors]
749 idtunr6/s
751 The number of ICMP Destination Unreachable messages re‐
752 ceived by the interface per second [ipv6IfIcmpInDestUn‐
753 reachs].
754 odtunr6/s
756 The number of ICMP Destination Unreachable messages sent
757 by the interface per second [ipv6IfIcmpOutDestUnreachs].
758 itmex6/s
760 The number of ICMP Time Exceeded messages received by the
761 interface per second [ipv6IfIcmpInTimeExcds].
762 otmex6/s
764 The number of ICMP Time Exceeded messages sent by the in‐
765 terface per second [ipv6IfIcmpOutTimeExcds].
766 iprmpb6/s
768 The number of ICMP Parameter Problem messages received by
769 the interface per second [ipv6IfIcmpInParmProblems].
770 oprmpb6/s
772 The number of ICMP Parameter Problem messages sent by the
773 interface per second [ipv6IfIcmpOutParmProblems].
774 iredir6/s
776 The number of Redirect messages received by the interface
777 per second [ipv6IfIcmpInRedirects].
778 oredir6/s
780 The number of Redirect messages sent by the interface by
781 second [ipv6IfIcmpOutRedirects].
782 ipck2b6/s
784 The number of ICMP Packet Too Big messages received by
785 the interface per second [ipv6IfIcmpInPktTooBigs].
786 opck2b6/s
788 The number of ICMP Packet Too Big messages sent by the
789 interface per second [ipv6IfIcmpOutPktTooBigs].
790 With the IP keyword, statistics about IPv4 network traffic are
793 reported. Note that IPv4 statistics depend on sadc's option -S
794 SNMP to be collected. The following values are displayed (for‐
795 mal SNMP names between square brackets):
796 irec/s The total number of input datagrams received from inter‐
798 faces per second, including those received in error [ip‐
799 InReceives].
800 fwddgm/s
802 The number of input datagrams per second, for which this
803 entity was not their final IP destination, as a result of
804 which an attempt was made to find a route to forward them
805 to that final destination [ipForwDatagrams].
806 idel/s The total number of input datagrams successfully deliv‐
808 ered per second to IP user-protocols (including ICMP)
809 [ipInDelivers].
810 orq/s The total number of IP datagrams which local IP user-pro‐
812 tocols (including ICMP) supplied per second to IP in re‐
813 quests for transmission [ipOutRequests]. Note that this
814 counter does not include any datagrams counted in fwd‐
815 dgm/s.
816 asmrq/s
818 The number of IP fragments received per second which
819 needed to be reassembled at this entity [ipReasmReqds].
820 asmok/s
822 The number of IP datagrams successfully re-assembled per
823 second [ipReasmOKs].
824 fragok/s
826 The number of IP datagrams that have been successfully
827 fragmented at this entity per second [ipFragOKs].
828 fragcrt/s
830 The number of IP datagram fragments that have been gener‐
831 ated per second as a result of fragmentation at this en‐
832 tity [ipFragCreates].
833 With the EIP keyword, statistics about IPv4 network errors are
836 reported. Note that IPv4 statistics depend on sadc's option -S
837 SNMP to be collected. The following values are displayed (for‐
838 mal SNMP names between square brackets):
839 ihdrerr/s
841 The number of input datagrams discarded per second due to
842 errors in their IP headers, including bad checksums, ver‐
843 sion number mismatch, other format errors, time-to-live
844 exceeded, errors discovered in processing their IP op‐
845 tions, etc. [ipInHdrErrors]
846 iadrerr/s
848 The number of input datagrams discarded per second be‐
849 cause the IP address in their IP header's destination
850 field was not a valid address to be received at this en‐
851 tity. This count includes invalid addresses (e.g.,
852 0.0.0.0) and addresses of unsupported Classes (e.g.,
853 Class E). For entities which are not IP routers and
854 therefore do not forward datagrams, this counter includes
855 datagrams discarded because the destination address was
856 not a local address [ipInAddrErrors].
857 iukwnpr/s
859 The number of locally-addressed datagrams received suc‐
860 cessfully but discarded per second because of an unknown
861 or unsupported protocol [ipInUnknownProtos].
862 idisc/s
864 The number of input IP datagrams per second for which no
865 problems were encountered to prevent their continued pro‐
866 cessing, but which were discarded (e.g., for lack of buf‐
867 fer space) [ipInDiscards]. Note that this counter does
868 not include any datagrams discarded while awaiting re-as‐
869 sembly.
870 odisc/s
872 The number of output IP datagrams per second for which no
873 problem was encountered to prevent their transmission to
874 their destination, but which were discarded (e.g., for
875 lack of buffer space) [ipOutDiscards]. Note that this
876 counter would include datagrams counted in fwddgm/s if
877 any such packets met this (discretionary) discard crite‐
878 rion.
879 onort/s
881 The number of IP datagrams discarded per second because
882 no route could be found to transmit them to their desti‐
883 nation [ipOutNoRoutes]. Note that this counter includes
884 any packets counted in fwddgm/s which meet this 'no-
885 route' criterion. Note that this includes any datagrams
886 which a host cannot route because all of its default
887 routers are down.
888 asmf/s The number of failures detected per second by the IP re-
890 assembly algorithm (for whatever reason: timed out, er‐
891 rors, etc) [ipReasmFails]. Note that this is not neces‐
892 sarily a count of discarded IP fragments since some algo‐
893 rithms can lose track of the number of fragments by com‐
894 bining them as they are received.
895 fragf/s
897 The number of IP datagrams that have been discarded per
898 second because they needed to be fragmented at this en‐
899 tity but could not be, e.g., because their Don't Fragment
900 flag was set [ipFragFails].
901 With the IP6 keyword, statistics about IPv6 network traffic are
904 reported. Note that IPv6 statistics depend on sadc's option -S
905 IPV6 to be collected. The following values are displayed (for‐
906 mal SNMP names between square brackets):
907 irec6/s
909 The total number of input datagrams received from inter‐
910 faces per second, including those received in error
911 [ipv6IfStatsInReceives].
912 fwddgm6/s
914 The number of output datagrams per second which this en‐
915 tity received and forwarded to their final destinations
916 [ipv6IfStatsOutForwDatagrams].
917 idel6/s
919 The total number of datagrams successfully delivered per
920 second to IPv6 user-protocols (including ICMP) [ipv6IfS‐
921 tatsInDelivers].
922 orq6/s The total number of IPv6 datagrams which local IPv6 user-
924 protocols (including ICMP) supplied per second to IPv6 in
925 requests for transmission [ipv6IfStatsOutRequests]. Note
926 that this counter does not include any datagrams counted
927 in fwddgm6/s.
928 asmrq6/s
930 The number of IPv6 fragments received per second which
931 needed to be reassembled at this interface [ipv6IfStat‐
932 sReasmReqds].
933 asmok6/s
935 The number of IPv6 datagrams successfully reassembled per
936 second [ipv6IfStatsReasmOKs].
937 imcpck6/s
939 The number of multicast packets received per second by
940 the interface [ipv6IfStatsInMcastPkts].
941 omcpck6/s
943 The number of multicast packets transmitted per second by
944 the interface [ipv6IfStatsOutMcastPkts].
945 fragok6/s
947 The number of IPv6 datagrams that have been successfully
948 fragmented at this output interface per second [ipv6IfS‐
949 tatsOutFragOKs].
950 fragcr6/s
952 The number of output datagram fragments that have been
953 generated per second as a result of fragmentation at this
954 output interface [ipv6IfStatsOutFragCreates].
955 With the EIP6 keyword, statistics about IPv6 network errors are
958 reported. Note that IPv6 statistics depend on sadc's option -S
959 IPV6 to be collected. The following values are displayed (for‐
960 mal SNMP names between square brackets):
961 ihdrer6/s
963 The number of input datagrams discarded per second due to
964 errors in their IPv6 headers, including version number
965 mismatch, other format errors, hop count exceeded, errors
966 discovered in processing their IPv6 options, etc.
967 [ipv6IfStatsInHdrErrors]
968 iadrer6/s
970 The number of input datagrams discarded per second be‐
971 cause the IPv6 address in their IPv6 header's destination
972 field was not a valid address to be received at this en‐
973 tity. This count includes invalid addresses (e.g., ::0)
974 and unsupported addresses (e.g., addresses with unallo‐
975 cated prefixes). For entities which are not IPv6 routers
976 and therefore do not forward datagrams, this counter in‐
977 cludes datagrams discarded because the destination ad‐
978 dress was not a local address [ipv6IfStatsInAddrErrors].
979 iukwnp6/s
981 The number of locally-addressed datagrams received suc‐
982 cessfully but discarded per second because of an unknown
983 or unsupported protocol [ipv6IfStatsInUnknownProtos].
984 i2big6/s
986 The number of input datagrams that could not be forwarded
987 per second because their size exceeded the link MTU of
988 outgoing interface [ipv6IfStatsInTooBigErrors].
989 idisc6/s
991 The number of input IPv6 datagrams per second for which
992 no problems were encountered to prevent their continued
993 processing, but which were discarded (e.g., for lack of
994 buffer space) [ipv6IfStatsInDiscards]. Note that this
995 counter does not include any datagrams discarded while
996 awaiting re-assembly.
997 odisc6/s
999 The number of output IPv6 datagrams per second for which
1000 no problem was encountered to prevent their transmission
1001 to their destination, but which were discarded (e.g., for
1002 lack of buffer space) [ipv6IfStatsOutDiscards]. Note that
1003 this counter would include datagrams counted in fwddgm6/s
1004 if any such packets met this (discretionary) discard cri‐
1005 terion.
1006 inort6/s
1008 The number of input datagrams discarded per second be‐
1009 cause no route could be found to transmit them to their
1010 destination [ipv6IfStatsInNoRoutes].
1011 onort6/s
1013 The number of locally generated IP datagrams discarded
1014 per second because no route could be found to transmit
1015 them to their destination [unknown formal SNMP name].
1016 asmf6/s
1018 The number of failures detected per second by the IPv6
1019 re-assembly algorithm (for whatever reason: timed out,
1020 errors, etc.) [ipv6IfStatsReasmFails]. Note that this is
1021 not necessarily a count of discarded IPv6 fragments since
1022 some algorithms can lose track of the number of fragments
1023 by combining them as they are received.
1024 fragf6/s
1026 The number of IPv6 datagrams that have been discarded per
1027 second because they needed to be fragmented at this out‐
1028 put interface but could not be [ipv6IfStatsOutFragFails].
1029 itrpck6/s
1031 The number of input datagrams discarded per second be‐
1032 cause datagram frame didn't carry enough data [ipv6IfS‐
1033 tatsInTruncatedPkts].
1034 With the NFS keyword, statistics about NFS client activity are
1037 reported. The following values are displayed:
1038 call/s Number of RPC requests made per second.
1040 retrans/s
1042 Number of RPC requests per second, those which needed to
1043 be retransmitted (for example because of a server time‐
1044 out).
1045 read/s Number of 'read' RPC calls made per second.
1047 write/s
1049 Number of 'write' RPC calls made per second.
1050 access/s
1052 Number of 'access' RPC calls made per second.
1053 getatt/s
1055 Number of 'getattr' RPC calls made per second.
1056 With the NFSD keyword, statistics about NFS server activity are
1059 reported. The following values are displayed:
1060 scall/s
1062 Number of RPC requests received per second.
1063 badcall/s
1065 Number of bad RPC requests received per second, those
1066 whose processing generated an error.
1067 packet/s
1069 Number of network packets received per second.
1070 udp/s Number of UDP packets received per second.
1072 tcp/s Number of TCP packets received per second.
1074 hit/s Number of reply cache hits per second.
1076 miss/s Number of reply cache misses per second.
1078 sread/s
1080 Number of 'read' RPC calls received per second.
1081 swrite/s
1083 Number of 'write' RPC calls received per second.
1084 saccess/s
1086 Number of 'access' RPC calls received per second.
1087 sgetatt/s
1089 Number of 'getattr' RPC calls received per second.
1090 With the SOCK keyword, statistics on sockets in use are reported
1093 (IPv4). The following values are displayed:
1094 totsck Total number of sockets used by the system.
1096 tcpsck Number of TCP sockets currently in use.
1098 udpsck Number of UDP sockets currently in use.
1100 rawsck Number of RAW sockets currently in use.
1102 ip-frag
1104 Number of IP fragments currently in queue.
1105 tcp-tw Number of TCP sockets in TIME_WAIT state.
1107 With the SOCK6 keyword, statistics on sockets in use are re‐
1110 ported (IPv6). Note that IPv6 statistics depend on sadc's op‐
1111 tion -S IPV6 to be collected. The following values are dis‐
1112 played:
1113 tcp6sck
1115 Number of TCPv6 sockets currently in use.
1116 udp6sck
1118 Number of UDPv6 sockets currently in use.
1119 raw6sck
1121 Number of RAWv6 sockets currently in use.
1122 ip6-frag
1124 Number of IPv6 fragments currently in use.
1125 With the SOFT keyword, statistics about software-based network
1128 processing are reported. The following values are displayed:
1129 total/s
1131 The total number of network frames processed per second.
1132 dropd/s
1134 The total number of network frames dropped per second be‐
1135 cause there was no room on the processing queue.
1136 squeezd/s
1138 The number of times the softirq handler function termi‐
1139 nated per second because its budget was consumed or the
1140 time limit was reached, but more work could have been
1141 done.
1142 rx_rps/s
1144 The number of times the CPU has been woken up per second
1145 to process packets via an inter-processor interrupt.
1146 flw_lim/s
1148 The number of times the flow limit has been reached per
1149 second. Flow limiting is an optional RPS feature that
1150 can be used to limit the number of packets queued to the
1151 backlog for each flow to a certain amount. This can help
1152 ensure that smaller flows are processed even though much
1153 larger flows are pushing packets in.
1154 With the TCP keyword, statistics about TCPv4 network traffic are
1157 reported. Note that TCPv4 statistics depend on sadc's option -S
1158 SNMP to be collected. The following values are displayed (for‐
1159 mal SNMP names between square brackets):
1160 active/s
1162 The number of times TCP connections have made a direct
1163 transition to the SYN-SENT state from the CLOSED state
1164 per second [tcpActiveOpens].
1165 passive/s
1167 The number of times TCP connections have made a direct
1168 transition to the SYN-RCVD state from the LISTEN state
1169 per second [tcpPassiveOpens].
1170 iseg/s The total number of segments received per second, includ‐
1172 ing those received in error [tcpInSegs]. This count in‐
1173 cludes segments received on currently established connec‐
1174 tions.
1175 oseg/s The total number of segments sent per second, including
1177 those on current connections but excluding those contain‐
1178 ing only retransmitted octets [tcpOutSegs].
1179 With the ETCP keyword, statistics about TCPv4 network errors are
1182 reported. Note that TCPv4 statistics depend on sadc's option -S
1183 SNMP to be collected. The following values are displayed (for‐
1184 mal SNMP names between square brackets):
1185 atmptf/s
1187 The number of times per second TCP connections have made
1188 a direct transition to the CLOSED state from either the
1189 SYN-SENT state or the SYN-RCVD state, plus the number of
1190 times per second TCP connections have made a direct tran‐
1191 sition to the LISTEN state from the SYN-RCVD state [tc‐
1192 pAttemptFails].
1193 estres/s
1195 The number of times per second TCP connections have made
1196 a direct transition to the CLOSED state from either the
1197 ESTABLISHED state or the CLOSE-WAIT state [tcpEstabRe‐
1198 sets].
1199 retrans/s
1201 The total number of segments retransmitted per second -
1202 that is, the number of TCP segments transmitted contain‐
1203 ing one or more previously transmitted octets [tcpRe‐
1204 transSegs].
1205 isegerr/s
1207 The total number of segments received in error (e.g., bad
1208 TCP checksums) per second [tcpInErrs].
1209 orsts/s
1211 The number of TCP segments sent per second containing the
1212 RST flag [tcpOutRsts].
1213 With the UDP keyword, statistics about UDPv4 network traffic are
1216 reported. Note that UDPv4 statistics depend on sadc's option -S
1217 SNMP to be collected. The following values are displayed (for‐
1218 mal SNMP names between square brackets):
1219 idgm/s The total number of UDP datagrams delivered per second to
1221 UDP users [udpInDatagrams].
1222 odgm/s The total number of UDP datagrams sent per second from
1224 this entity [udpOutDatagrams].
1225 noport/s
1227 The total number of received UDP datagrams per second for
1228 which there was no application at the destination port
1229 [udpNoPorts].
1230 idgmerr/s
1232 The number of received UDP datagrams per second that
1233 could not be delivered for reasons other than the lack of
1234 an application at the destination port [udpInErrors].
1235 With the UDP6 keyword, statistics about UDPv6 network traffic
1238 are reported. Note that UDPv6 statistics depend on sadc's op‐
1239 tion -S IPV6 to be collected. The following values are dis‐
1240 played (formal SNMP names between square brackets):
1241 idgm6/s
1243 The total number of UDP datagrams delivered per second to
1244 UDP users [udpInDatagrams].
1245 odgm6/s
1247 The total number of UDP datagrams sent per second from
1248 this entity [udpOutDatagrams].
1249 noport6/s
1251 The total number of received UDP datagrams per second for
1252 which there was no application at the destination port
1253 [udpNoPorts].
1254 idgmer6/s
1256 The number of received UDP datagrams per second that
1257 could not be delivered for reasons other than the lack of
1258 an application at the destination port [udpInErrors].
1259 The ALL keyword is equivalent to specifying all the keywords
1262 above and therefore all the network activities are reported.
1263 -o [ filename ]
1265 Save the readings in the file in binary form. Each reading is in
1266 a separate record. The default value of the filename parameter
1267 is the current standard system activity daily data file. If
1268 filename is a directory instead of a plain file then it is con‐
1269 sidered as the directory where the standard system activity
1270 daily data files are located. Option -o is exclusive of option
1271 -f. All the data available from the kernel are saved in the
1272 file (in fact, sar calls its data collector sadc with the option
1273 -S ALL. See sadc(8) manual page).
1274 -P { cpu_list | ALL }
1276 Report per-processor statistics for the specified processor or
1277 processors. cpu_list is a list of comma-separated values or
1278 range of values (e.g., 0,2,4-7,12-). Note that processor 0 is
1279 the first processor, and processor all is the global average
1280 among all processors. Specifying the ALL keyword reports sta‐
1281 tistics for each individual processor, and globally for all pro‐
1282 cessors. Offline processors are not displayed.
1283 -p, --pretty
1285 Make reports easier to read by a human. This option may be es‐
1286 pecially useful when displaying e.g., network interfaces or
1287 block devices statistics.
1288 -q [ keyword[,...] | ALL ]
1290 Report system load and pressure-stall statistics.
1291 Possible keywords are CPU, IO, LOAD, MEM and PSI".
1293 With the CPU keyword, CPU pressure statistics are reported. The
1295 following values are displayed:
1296 %scpu-10
1298 Percentage of the time that at least some runnable tasks
1299 were delayed because the CPU was unavailable to them,
1300 over the last 10 second window.
1301 %scpu-60
1303 Percentage of the time that at least some runnable tasks
1304 were delayed because the CPU was unavailable to them,
1305 over the last 60 second window.
1306 %scpu-300
1308 Percentage of the time that at least some runnable tasks
1309 were delayed because the CPU was unavailable to them,
1310 over the last 300 second window.
1311 %scpu Percentage of the time that at least some runnable tasks
1313 were delayed because the CPU was unavailable to them,
1314 over the last time interval.
1315 With the IO keyword, I/O pressure statistics are reported. The
1318 following values are displayed:
1319 %sio-10
1321 Percentage of the time that at least some tasks lost
1322 waiting for I/O, over the last 10 second window.
1323 %sio-60
1325 Percentage of the time that at least some tasks lost
1326 waiting for I/O, over the last 60 second window.
1327 %sio-300
1329 Percentage of the time that at least some tasks lost
1330 waiting for I/O, over the last 300 second window.
1331 %sio Percentage of the time that at least some tasks lost
1333 waiting for I/O, over the last time interval.
1334 %fio-10
1336 Percentage of the time during which all non-idle tasks
1337 were stalled waiting for I/O, over the last 10 second
1338 window.
1339 %fio-60
1341 Percentage of the time during which all non-idle tasks
1342 were stalled waiting for I/O, over the last 60 second
1343 window.
1344 %fio-300
1346 Percentage of the time during which all non-idle tasks
1347 were stalled waiting for I/O, over the last 300 second
1348 window.
1349 %fio Percentage of the time during which all non-idle tasks
1351 were stalled waiting for I/O, over the last time inter‐
1352 val.
1353 With the LOAD keyword, queue length and load averages statistics
1356 are reported. The following values are displayed:
1357 runq-sz
1359 Run queue length (number of tasks running or waiting for
1360 run time).
1361 plist-sz
1363 Number of tasks in the task list.
1364 ldavg-1
1366 System load average for the last minute. The load aver‐
1367 age is calculated as the average number of runnable or
1368 running tasks (R state), and the number of tasks in unin‐
1369 terruptible sleep (D state) over the specified interval.
1370 ldavg-5
1372 System load average for the past 5 minutes.
1373 ldavg-15
1375 System load average for the past 15 minutes.
1376 blocked
1378 Number of tasks currently blocked, waiting for I/O to
1379 complete.
1380 With the MEM keyword, memory pressure statistics are reported.
1383 The following values are displayed:
1384 %smem-10
1386 Percentage of the time during which at least some tasks
1387 were waiting for memory resources, over the last 10 sec‐
1388 ond window.
1389 %smem-60
1391 Percentage of the time during which at least some tasks
1392 were waiting for memory resources, over the last 60 sec‐
1393 ond window.
1394 %smem-300
1396 Percentage of the time during which at least some tasks
1397 were waiting for memory resources, over the last 300 sec‐
1398 ond window.
1399 %smem Percentage of the time during which at least some tasks
1401 were waiting for memory resources, over the last time in‐
1402 terval.
1403 %fmem-10
1405 Percentage of the time during which all non-idle tasks
1406 were stalled waiting for memory resources, over the last
1407 10 second window.
1408 %fmem-60
1410 Percentage of the time during which all non-idle tasks
1411 were stalled waiting for memory resources, over the last
1412 60 second window.
1413 %fmem-300
1415 Percentage of the time during which all non-idle tasks
1416 were stalled waiting for memory resources, over the last
1417 300 second window.
1418 %fmem Percentage of the time during which all non-idle tasks
1420 were stalled waiting for memory resources, over the last
1421 time interval.
1422 The PSI keyword is equivalent to specifying CPU, IO and MEM key‐
1425 words together and therefore all the pressure-stall statistics
1426 are reported.
1427 The ALL keyword is equivalent to specifying all the keywords
1429 above and therefore all the statistics are reported.
1430 -r [ ALL ]
1432 Report memory utilization statistics. The ALL keyword indicates
1433 that all the memory fields should be displayed. The following
1434 values may be displayed:
1435 kbmemfree
1437 Amount of free memory available in kilobytes.
1438 kbavail
1440 Estimate of how much memory in kilobytes is available for
1441 starting new applications, without swapping. The esti‐
1442 mate takes into account that the system needs some page
1443 cache to function well, and that not all reclaimable slab
1444 will be reclaimable, due to items being in use. The im‐
1445 pact of those factors will vary from system to system.
1446 kbmemused
1448 Amount of used memory in kilobytes (calculated as total
1449 installed memory - kbmemfree - kbbuffers - kbcached - kb‐
1450 slab).
1451 %memused
1453 Percentage of used memory.
1454 kbbuffers
1456 Amount of memory used as buffers by the kernel in kilo‐
1457 bytes.
1458 kbcached
1460 Amount of memory used to cache data by the kernel in
1461 kilobytes.
1462 kbcommit
1464 Amount of memory in kilobytes needed for current work‐
1465 load. This is an estimate of how much RAM/swap is needed
1466 to guarantee that there never is out of memory.
1467 %commit
1469 Percentage of memory needed for current workload in rela‐
1470 tion to the total amount of memory (RAM+swap). This num‐
1471 ber may be greater than 100% because the kernel usually
1472 overcommits memory.
1473 kbactive
1475 Amount of active memory in kilobytes (memory that has
1476 been used more recently and usually not reclaimed unless
1477 absolutely necessary).
1478 kbinact
1480 Amount of inactive memory in kilobytes (memory which has
1481 been less recently used. It is more eligible to be re‐
1482 claimed for other purposes).
1483 kbdirty
1485 Amount of memory in kilobytes waiting to get written back
1486 to the disk.
1487 kbanonpg
1489 Amount of non-file backed pages in kilobytes mapped into
1490 userspace page tables.
1491 kbslab Amount of memory in kilobytes used by the kernel to cache
1493 data structures for its own use.
1494 kbkstack
1496 Amount of memory in kilobytes used for kernel stack
1497 space.
1498 kbpgtbl
1500 Amount of memory in kilobytes dedicated to the lowest
1501 level of page tables.
1502 kbvmused
1504 Amount of memory in kilobytes of used virtual address
1505 space.
1506 -S Report swap space utilization statistics. The following values
1508 are displayed:
1509 kbswpfree
1511 Amount of free swap space in kilobytes.
1512 kbswpused
1514 Amount of used swap space in kilobytes.
1515 %swpused
1517 Percentage of used swap space.
1518 kbswpcad
1520 Amount of cached swap memory in kilobytes. This is mem‐
1521 ory that once was swapped out, is swapped back in but
1522 still also is in the swap area (if memory is needed it
1523 doesn't need to be swapped out again because it is al‐
1524 ready in the swap area. This saves I/O).
1525 %swpcad
1527 Percentage of cached swap memory in relation to the
1528 amount of used swap space.
1529 -s [ hh:mm[:ss] ]
1531 Set the starting time of the data, causing the sar command to
1532 extract records time-tagged at, or following, the time speci‐
1533 fied. The default starting time is 08:00:00. Hours must be
1534 given in 24-hour format. This option can be used only when data
1535 are read from a file (option -f).
1536 --sadc Indicate which data collector is called by sar. If the data
1538 collector is sought in PATH then enter "which sadc" to know
1539 where it is located.
1540 -t When reading data from a daily data file, indicate that sar
1542 should display the timestamps in the original local time of the
1543 data file creator. Without this option, the sar command displays
1544 the timestamps in the user's locale time.
1545 -u [ ALL ]
1547 Report CPU utilization. The ALL keyword indicates that all the
1548 CPU fields should be displayed. The report may show the follow‐
1549 ing fields:
1550 %user Percentage of CPU utilization that occurred while execut‐
1552 ing at the user level (application). Note that this field
1553 includes time spent running virtual processors.
1554 %usr Percentage of CPU utilization that occurred while execut‐
1556 ing at the user level (application). Note that this field
1557 does NOT include time spent running virtual processors.
1558 %nice Percentage of CPU utilization that occurred while execut‐
1560 ing at the user level with nice priority.
1561 %system
1563 Percentage of CPU utilization that occurred while execut‐
1564 ing at the system level (kernel). Note that this field
1565 includes time spent servicing hardware and software in‐
1566 terrupts.
1567 %sys Percentage of CPU utilization that occurred while execut‐
1569 ing at the system level (kernel). Note that this field
1570 does NOT include time spent servicing hardware or soft‐
1571 ware interrupts.
1572 %iowait
1574 Percentage of time that the CPU or CPUs were idle during
1575 which the system had an outstanding disk I/O request.
1576 %steal Percentage of time spent in involuntary wait by the vir‐
1578 tual CPU or CPUs while the hypervisor was servicing an‐
1579 other virtual processor.
1580 %irq Percentage of time spent by the CPU or CPUs to service
1582 hardware interrupts.
1583 %soft Percentage of time spent by the CPU or CPUs to service
1585 software interrupts.
1586 %guest Percentage of time spent by the CPU or CPUs to run a vir‐
1588 tual processor.
1589 %gnice Percentage of time spent by the CPU or CPUs to run a
1591 niced guest.
1592 %idle Percentage of time that the CPU or CPUs were idle and the
1594 system did not have an outstanding disk I/O request.
1595 -V Print version number then exit.
1597 -v Report status of inode, file and other kernel tables. The fol‐
1599 lowing values are displayed:
1600 dentunusd
1602 Number of unused cache entries in the directory cache.
1603 file-nr
1605 Number of file handles used by the system.
1606 inode-nr
1608 Number of inode handlers used by the system.
1609 pty-nr Number of pseudo-terminals used by the system.
1611 -W Report swapping statistics. The following values are displayed:
1613 pswpin/s
1615 Total number of swap pages the system brought in per sec‐
1616 ond.
1617 pswpout/s
1619 Total number of swap pages the system brought out per
1620 second.
1621 -w Report task creation and system switching activity. The follow‐
1623 ing values are displayed:
1624 proc/s Total number of tasks created per second.
1626 cswch/s
1628 Total number of context switches per second.
1629 -y Report TTY devices activity. The following values are displayed:
1631 rcvin/s
1633 Number of receive interrupts per second for current se‐
1634 rial line. Serial line number is given in the TTY col‐
1635 umn.
1636 xmtin/s
1638 Number of transmit interrupts per second for current se‐
1639 rial line.
1640 framerr/s
1642 Number of frame errors per second for current serial
1643 line.
1644 prtyerr/s
1646 Number of parity errors per second for current serial
1647 line.
1648 brk/s Number of breaks per second for current serial line.
1650 ovrun/s
1652 Number of overrun errors per second for current serial
1653 line.
1654 -z Tell sar to omit output for any devices for which there was no
1656 activity during the sample period.
1657
1660 The sar command takes into account the following environment variables:
1661 S_COLORS
1663 By default statistics are displayed in color when the output is
1664 connected to a terminal. Use this variable to change the set‐
1665 tings. Possible values for this variable are never, always or
1666 auto (the latter is equivalent to the default settings).
1667 Please note that the color (being red, yellow, or some other
1668 color) used to display a value is not indicative of any kind of
1669 issue simply because of the color. It only indicates different
1670 ranges of values.
1671 S_COLORS_SGR
1673 Specify the colors and other attributes used to display statis‐
1674 tics on the terminal. Its value is a colon-separated list of
1675 capabilities that defaults to
1676 C=33;22:H=31;1:I=32;22:M=35;1:N=34;1:R=31;22:Z=34;22. Supported
1677 capabilities are:
1678 C= SGR (Select Graphic Rendition) substring for comments in‐
1680 serted in the binary daily data files.
1681 H= SGR substring for percentage values greater than or equal
1683 to 75%.
1684 I= SGR substring for item names or values (eg. network in‐
1686 terfaces, CPU number...)
1687 M= SGR substring for percentage values in the range from 50%
1689 to 75%.
1690 N= SGR substring for non-zero statistics values.
1692 R= SGR substring for restart messages.
1694 Z= SGR substring for zero values.
1696 S_TIME_DEF_TIME
1698 If this variable exists and its value is UTC then sar will save
1699 its data in UTC time (data will still be displayed in local
1700 time). sar will also use UTC time instead of local time to de‐
1701 termine the current daily data file located in the /var/log/sa
1702 directory. This variable may be useful for servers with users
1703 located across several timezones.
1704 S_TIME_FORMAT
1706 If this variable exists and its value is ISO then the current
1707 locale will be ignored when printing the date in the report
1708 header. The sar command will use the ISO 8601 format (YYYY-MM-
1709 DD) instead. The timestamp will also be compliant with ISO 8601
1710 format.
1711
1714 sar -u 2 5
1715 Report CPU utilization for each 2 seconds. 5 lines are dis‐
1716 played.
1717 sar -I 14 -o int14.file 2 10
1719 Report statistics on IRQ 14 for each 2 seconds. 10 lines are
1720 displayed. Data are stored in a file called int14.file.
1721 sar -r -n DEV -f /var/log/sa/sa16
1723 Display memory and network statistics saved in daily data file
1724 sa16.
1725 sar -A Display all the statistics saved in current daily data file.
1727
1730 /proc filesystem must be mounted for the sar command to work.
1731 All the statistics are not necessarily available, depending on the ker‐
1733 nel version used. sar assumes that you are using at least a 2.6 ker‐
1734 nel.
1735 Although sar speaks of kilobytes (kB), megabytes (MB)..., it actually
1737 uses kibibytes (kiB), mebibytes (MiB)... A kibibyte is equal to 1024
1738 bytes, and a mebibyte is equal to 1024 kibibytes.
1739
1742 /var/log/sa/saDD
1743 /var/log/sa/saYYYYMMDD
1744 The standard system activity daily data files and their default
1745 location. YYYY stands for the current year, MM for the current
1746 month and DD for the current day.
1747 /proc and /sys contain various files with system statistics.
1749
1752 Sebastien Godard (sysstat <at> orange.fr)
1753
1756 sadc(8), sa1(8), sa2(8), sadf(1), sysstat(5), pidstat(1), mpstat(1),
1757 iostat(1), vmstat(8)
1758 https://github.com/sysstat/sysstat
1760 http://pagesperso-orange.fr/sebastien.godard/
1761Linux JANUARY 2022 SAR(1)