1SAR(1) Linux User's Manual SAR(1)
2
6 sar - Collect, report, or save system activity information.
7
10 sar [ -A ] [ -B ] [ -b ] [ -C ] [ -D ] [ -d ] [ -F [ MOUNT ] ] [ -H ] [
11 -h ] [ -p ] [ -r [ ALL ] ] [ -S ] [ -t ] [ -u [ ALL ] ] [ -V ] [ -v ] [
12 -W ] [ -w ] [ -y ] [ -z ] [ --dec={ 0 | 1 | 2 } ] [ --dev=dev_list ] [
13 --fs=fs_list ] [ --help ] [ --human ] [ --iface=iface_list ] [
14 --int=int_list ] [ --pretty ] [ --sadc ] [ -I [ SUM | ALL ] ] [ -P {
15 cpu_list | ALL } ] [ -m { keyword[,...] | ALL } ] [ -n { keyword[,...]
16 | ALL } ] [ -q [ keyword[,...] | ALL ] ] [ -j { SID | ID | LABEL | PATH
17 | UUID | ... } ] [ -f [ filename ] | -o [ filename ] | -[0-9]+ ] [ -i
18 interval ] [ -s [ hh:mm[:ss] ] ] [ -e [ hh:mm[:ss] ] ] [ interval [
19 count ] ]
20
23 The sar command writes to standard output the contents of selected cu‐
24 mulative activity counters in the operating system. The accounting sys‐
25 tem, based on the values in the count and interval parameters, writes
26 information the specified number of times spaced at the specified in‐
27 tervals in seconds. If the interval parameter is set to zero, the sar
28 command displays the average statistics for the time since the system
29 was started. If the interval parameter is specified without the count
30 parameter, then reports are generated continuously. The collected data
31 can also be saved in the file specified by the -o filename flag, in ad‐
32 dition to being displayed onto the screen. If filename is omitted, sar
33 uses the standard system activity daily data file (see below). By de‐
34 fault all the data available from the kernel are saved in the data
35 file.
36 The sar command extracts and writes to standard output records previ‐
38 ously saved in a file. This file can be either the one specified by the
39 -f flag or, by default, the standard system activity daily data file.
40 It is also possible to enter -1, -2 etc. as an argument to sar to dis‐
41 play data of that days ago. For example, -1 will point at the standard
42 system activity file of yesterday.
43 Standard system activity daily data files are named saDD or saYYYYMMDD,
45 where YYYY stands for the current year, MM for the current month and DD
46 for the current day. They are the default files used by sar only when
47 no filename has been explicitly specified. When used to write data to
48 files (with its option -o), sar will use saYYYYMMDD if option -D has
49 also been specified, else it will use saDD. When used to display the
50 records previously saved in a file, sar will look for the most recent
51 of saDD and saYYYYMMDD, and use it.
52 Standard system activity daily data files are located in the
54 /var/log/sa directory by default. Yet it is possible to specify an al‐
55 ternate location for them: If a directory (instead of a plain file) is
56 used with options -f or -o then it will be considered as the directory
57 containing the data files.
58 Without the -P flag, the sar command reports system-wide (global among
60 all processors) statistics, which are calculated as averages for values
61 expressed as percentages, and as sums otherwise. If the -P flag is
62 given, the sar command reports activity which relates to the specified
63 processor or processors. If -P ALL is given, the sar command reports
64 statistics for each individual processor and global statistics among
65 all processors. Offline processors are not displayed.
66 You can select information about specific system activities using
68 flags. Not specifying any flags selects only CPU activity. Specifying
69 the -A flag selects all possible activities.
70 The default version of the sar command (CPU utilization report) might
72 be one of the first facilities the user runs to begin system activity
73 investigation, because it monitors major system resources. If CPU uti‐
74 lization is near 100 percent (user + nice + system), the workload sam‐
75 pled is CPU-bound.
76 If multiple samples and multiple reports are desired, it is convenient
78 to specify an output file for the sar command. Run the sar command as a
79 background process. The syntax for this is:
80 sar -o datafile interval count >/dev/null 2>&1 &
82 All data are captured in binary form and saved to a file (datafile).
84 The data can then be selectively displayed with the sar command using
85 the -f option. Set the interval and count parameters to select count
86 records at interval second intervals. If the count parameter is not
87 set, all the records saved in the file will be selected. Collection of
88 data in this manner is useful to characterize system usage over a pe‐
89 riod of time and determine peak usage hours.
90 Note: The sar command only reports on local activities.
92
95 -A This is equivalent to specifying -bBdFHISvwWy -m ALL -n ALL -q
96 ALL -r ALL -u ALL. This option also implies specifying -I ALL
97 -P ALL unless these options are explicitly set on the command
98 line.
99 -B Report paging statistics. The following values are displayed:
101 pgpgin/s
103 Total number of kilobytes the system paged in from disk
104 per second.
105 pgpgout/s
107 Total number of kilobytes the system paged out to disk
108 per second.
109 fault/s
111 Number of page faults (major + minor) made by the system
112 per second. This is not a count of page faults that gen‐
113 erate I/O, because some page faults can be resolved with‐
114 out I/O.
115 majflt/s
117 Number of major faults the system has made per second,
118 those which have required loading a memory page from
119 disk.
120 pgfree/s
122 Number of pages placed on the free list by the system per
123 second.
124 pgscank/s
126 Number of pages scanned by the kswapd daemon per second.
127 pgscand/s
129 Number of pages scanned directly per second.
130 pgsteal/s
132 Number of pages the system has reclaimed from cache
133 (pagecache and swapcache) per second to satisfy its mem‐
134 ory demands.
135 %vmeff Calculated as pgsteal / pgscan, this is a metric of the
137 efficiency of page reclaim. If it is near 100% then al‐
138 most every page coming off the tail of the inactive list
139 is being reaped. If it gets too low (e.g. less than 30%)
140 then the virtual memory is having some difficulty. This
141 field is displayed as zero if no pages have been scanned
142 during the interval of time.
143 -b Report I/O and transfer rate statistics. The following values
145 are displayed:
146 tps Total number of transfers per second that were issued to
148 physical devices. A transfer is an I/O request to a
149 physical device. Multiple logical requests can be com‐
150 bined into a single I/O request to the device. A trans‐
151 fer is of indeterminate size.
152 rtps Total number of read requests per second issued to physi‐
154 cal devices.
155 wtps Total number of write requests per second issued to phys‐
157 ical devices.
158 dtps Total number of discard requests per second issued to
160 physical devices.
161 bread/s
163 Total amount of data read from the devices in blocks per
164 second. Blocks are equivalent to sectors and therefore
165 have a size of 512 bytes.
166 bwrtn/s
168 Total amount of data written to devices in blocks per
169 second.
170 bdscd/s
172 Total amount of data discarded for devices in blocks per
173 second.
174 -C When reading data from a file, tell sar to display comments that
176 have been inserted by sadc.
177 -D Use saYYYYMMDD instead of saDD as the standard system activity
179 daily data file name. This option works only when used in con‐
180 junction with option -o to save data to file.
181 -d Report activity for each block device. When data are displayed,
183 the device name is displayed as it (should) appear in /dev. sar
184 uses data in /sys to determine the device name based on its ma‐
185 jor and minor numbers. If this name resolution fails, sar will
186 use name mapping controlled by /etc/sysconfig/sysstat.ioconf
187 file. Persistent device names can also be printed if option -j
188 is used (see below). Statistics for all devices are displayed
189 unless a restricted list is specified using option --dev= (see
190 corresponding option entry). Note that disk activity depends on
191 sadc's options -S DISK and -S XDISK to be collected. The follow‐
192 ing values are displayed:
193 tps Total number of transfers per second that were issued to
195 physical devices. A transfer is an I/O request to a
196 physical device. Multiple logical requests can be com‐
197 bined into a single I/O request to the device. A trans‐
198 fer is of indeterminate size.
199 rkB/s Number of kilobytes read from the device per second.
201 wkB/s Number of kilobytes written to the device per second.
203 dkB/s Number of kilobytes discarded for the device per second.
205 areq-sz
207 The average size (in kilobytes) of the I/O requests that
208 were issued to the device.
209 Note: In previous versions, this field was known as av‐
210 grq-sz and was expressed in sectors.
211 aqu-sz The average queue length of the requests that were issued
213 to the device.
214 Note: In previous versions, this field was known as
215 avgqu-sz.
216 await The average time (in milliseconds) for I/O requests is‐
218 sued to the device to be served. This includes the time
219 spent by the requests in queue and the time spent servic‐
220 ing them.
221 %util Percentage of elapsed time during which I/O requests were
223 issued to the device (bandwidth utilization for the de‐
224 vice). Device saturation occurs when this value is close
225 to 100% for devices serving requests serially. But for
226 devices serving requests in parallel, such as RAID arrays
227 and modern SSDs, this number does not reflect their per‐
228 formance limits.
229 --dec={ 0 | 1 | 2 }
231 Specify the number of decimal places to use (0 to 2, default
232 value is 2).
233 --dev=dev_list
235 Specify the block devices for which statistics are to be dis‐
236 played by sar. dev_list is a list of comma-separated device
237 names.
238 -e [ hh:mm[:ss] ]
240 Set the ending time of the report. The default ending time is
241 18:00:00. Hours must be given in 24-hour format. This option
242 can be used when data are read from or written to a file (op‐
243 tions -f or -o).
244 -F [ MOUNT ]
246 Display statistics for currently mounted filesystems. Pseudo-
247 filesystems are ignored. At the end of the report, sar will dis‐
248 play a summary of all those filesystems. Use of the MOUNT param‐
249 eter keyword indicates that mountpoint will be reported instead
250 of filesystem device. Statistics for all filesystems are dis‐
251 played unless a restricted list is specified using option --fs=
252 (see corresponding option entry). Note that filesystems statis‐
253 tics depend on sadc's option -S XDISK to be collected.
254 The following values are displayed:
256 MBfsfree
258 Total amount of free space in megabytes (including space
259 available only to privileged user).
260 MBfsused
262 Total amount of space used in megabytes.
263 %fsused
265 Percentage of filesystem space used, as seen by a privi‐
266 leged user.
267 %ufsused
269 Percentage of filesystem space used, as seen by an un‐
270 privileged user.
271 Ifree Total number of free file nodes in filesystem.
273 Iused Total number of file nodes used in filesystem.
275 %Iused Percentage of file nodes used in filesystem.
277 -f [ filename ]
279 Extract records from filename (created by the -o filename flag).
280 The default value of the filename parameter is the current stan‐
281 dard system activity daily data file. If filename is a directory
282 instead of a plain file then it is considered as the directory
283 where the standard system activity daily data files are located.
284 Option -f is exclusive of option -o.
285 --fs=fs_list
287 Specify the filesystems for which statistics are to be displayed
288 by sar. fs_list is a list of comma-separated filesystem names
289 or mountpoints.
290 -H Report hugepages utilization statistics. The following values
292 are displayed:
293 kbhugfree
295 Amount of hugepages memory in kilobytes that is not yet
296 allocated.
297 kbhugused
299 Amount of hugepages memory in kilobytes that has been al‐
300 located.
301 %hugused
303 Percentage of total hugepages memory that has been allo‐
304 cated.
305 kbhugrsvd
307 Amount of reserved hugepages memory in kilobytes.
308 kbhugsurp
310 Amount of surplus hugepages memory in kilobytes.
311 -h This option is equivalent to specifying --pretty --human.
313 --help Display a short help message then exit.
315 --human
317 Print sizes in human readable format (e.g. 1.0k, 1.2M, etc.)
318 The units displayed with this option supersede any other default
319 units (e.g. kilobytes, sectors...) associated with the metrics.
320 -I [ SUM | ALL ]
322 Report statistics for interrupts. The values displayed are the
323 number of interrupts per second for the given processor or among
324 all processors. A list of interrupts can be specified using
325 --int= (see this option). The SUM keyword indicates that the to‐
326 tal number of interrupts received per second is to be displayed.
327 The ALL keyword indicates that statistics from all interrupts
328 are to be reported (this is the default). Note that interrupts
329 statistics depend on sadc's option -S INT to be collected.
330 -i interval
332 Select data records at seconds as close as possible to the num‐
333 ber specified by the interval parameter.
334 --iface=iface_list
336 Specify the network interfaces for which statistics are to be
337 displayed by sar. iface_list is a list of comma-separated in‐
338 terface names.
339 --int=int_list
341 Specify the interrupts names for which statistics are to be dis‐
342 played by sar. int_list is a list of comma-separated values or
343 range of values (e.g., 0-16,35,40-).
344 -j { SID | ID | LABEL | PATH | UUID | ... }
346 Display persistent device names. Use this option in conjunction
347 with option -d. Keywords ID, LABEL, etc. specify the type of the
348 persistent name. These keywords are not limited, only prerequi‐
349 site is that directory with required persistent names is present
350 in /dev/disk. Keyword SID tries to get a stable identifier to
351 use as the device name. A stable identifier won't change across
352 reboots for the same physical device. If it exists, this identi‐
353 fier is normally the WWN (World Wide Name) of the device, as
354 read from the /dev/disk/by-id directory.
355 -m { keyword[,...] | ALL }
357 Report power management statistics. Note that these statistics
358 depend on sadc's option -S POWER to be collected.
359 Possible keywords are CPU, FAN, FREQ, IN, TEMP and USB.
361 With the CPU keyword, statistics about CPU are reported. The
363 following value is displayed:
364 MHz Instantaneous CPU clock frequency in MHz.
366 With the FAN keyword, statistics about fans speed are reported.
369 The following values are displayed:
370 rpm Fan speed expressed in revolutions per minute.
372 drpm This field is calculated as the difference between cur‐
374 rent fan speed (rpm) and its low limit (fan_min).
375 DEVICE Sensor device name.
377 With the FREQ keyword, statistics about CPU clock frequency are
380 reported. The following value is displayed:
381 wghMHz Weighted average CPU clock frequency in MHz. Note that
383 the cpufreq-stats driver must be compiled in the kernel
384 for this option to work.
385 With the IN keyword, statistics about voltage inputs are re‐
388 ported. The following values are displayed:
389 inV Voltage input expressed in Volts.
391 %in Relative input value. A value of 100% means that voltage
393 input has reached its high limit (in_max) whereas a value
394 of 0% means that it has reached its low limit (in_min).
395 DEVICE Sensor device name.
397 With the TEMP keyword, statistics about devices temperature are
400 reported. The following values are displayed:
401 degC Device temperature expressed in degrees Celsius.
403 %temp Relative device temperature. A value of 100% means that
405 temperature has reached its high limit (temp_max).
406 DEVICE Sensor device name.
408 With the USB keyword, the sar command takes a snapshot of all
411 the USB devices currently plugged into the system. At the end of
412 the report, sar will display a summary of all those USB devices.
413 The following values are displayed:
414 BUS Root hub number of the USB device.
416 idvendor
418 Vendor ID number (assigned by USB organization).
419 idprod Product ID number (assigned by Manufacturer).
421 maxpower
423 Maximum power consumption of the device (expressed in
424 mA).
425 manufact
427 Manufacturer name.
428 product
430 Product name.
431 The ALL keyword is equivalent to specifying all the keywords
434 above and therefore all the power management statistics are re‐
435 ported.
436 -n { keyword[,...] | ALL }
438 Report network statistics.
439 Possible keywords are DEV, EDEV, FC, ICMP, EICMP, ICMP6, EICMP6,
441 IP, EIP, IP6, EIP6, NFS, NFSD, SOCK, SOCK6, SOFT, TCP, ETCP, UDP
442 and UDP6.
443 With the DEV keyword, statistics from the network devices are
445 reported. Statistics for all network interfaces are displayed
446 unless a restricted list is specified using option --iface= (see
447 corresponding option entry). The following values are dis‐
448 played:
449 IFACE Name of the network interface for which statistics are
451 reported.
452 rxpck/s
454 Total number of packets received per second.
455 txpck/s
457 Total number of packets transmitted per second.
458 rxkB/s Total number of kilobytes received per second.
460 txkB/s Total number of kilobytes transmitted per second.
462 rxcmp/s
464 Number of compressed packets received per second (for
465 cslip etc.).
466 txcmp/s
468 Number of compressed packets transmitted per second.
469 rxmcst/s
471 Number of multicast packets received per second.
472 %ifutil
474 Utilization percentage of the network interface. For
475 half-duplex interfaces, utilization is calculated using
476 the sum of rxkB/s and txkB/s as a percentage of the in‐
477 terface speed. For full-duplex, this is the greater of
478 rxkB/S or txkB/s.
479 With the EDEV keyword, statistics on failures (errors) from the
482 network devices are reported. Statistics for all network inter‐
483 faces are displayed unless a restricted list is specified using
484 option --iface= (see corresponding option entry). The following
485 values are displayed:
486 IFACE Name of the network interface for which statistics are
488 reported.
489 rxerr/s
491 Total number of bad packets received per second.
492 txerr/s
494 Total number of errors that happened per second while
495 transmitting packets.
496 coll/s Number of collisions that happened per second while
498 transmitting packets.
499 rxdrop/s
501 Number of received packets dropped per second because of
502 a lack of space in linux buffers.
503 txdrop/s
505 Number of transmitted packets dropped per second because
506 of a lack of space in linux buffers.
507 txcarr/s
509 Number of carrier-errors that happened per second while
510 transmitting packets.
511 rxfram/s
513 Number of frame alignment errors that happened per second
514 on received packets.
515 rxfifo/s
517 Number of FIFO overrun errors that happened per second on
518 received packets.
519 txfifo/s
521 Number of FIFO overrun errors that happened per second on
522 transmitted packets.
523 With the FC keyword, statistics about fibre channel traffic are
526 reported. Note that fibre channel statistics depend on sadc's
527 option -S DISK to be collected. The following values are dis‐
528 played:
529 FCHOST Name of the fibre channel host bus adapter (HBA) inter‐
531 face for which statistics are reported.
532 fch_rxf/s
534 The total number of frames received per second.
535 fch_txf/s
537 The total number of frames transmitted per second.
538 fch_rxw/s
540 The total number of transmission words received per sec‐
541 ond.
542 fch_txw/s
544 The total number of transmission words transmitted per
545 second.
546 With the ICMP keyword, statistics about ICMPv4 network traffic
549 are reported. Note that ICMPv4 statistics depend on sadc's op‐
550 tion -S SNMP to be collected. The following values are dis‐
551 played (formal SNMP names between square brackets):
552 imsg/s The total number of ICMP messages which the entity re‐
554 ceived per second [icmpInMsgs]. Note that this counter
555 includes all those counted by ierr/s.
556 omsg/s The total number of ICMP messages which this entity at‐
558 tempted to send per second [icmpOutMsgs]. Note that this
559 counter includes all those counted by oerr/s.
560 iech/s The number of ICMP Echo (request) messages received per
562 second [icmpInEchos].
563 iechr/s
565 The number of ICMP Echo Reply messages received per sec‐
566 ond [icmpInEchoReps].
567 oech/s The number of ICMP Echo (request) messages sent per sec‐
569 ond [icmpOutEchos].
570 oechr/s
572 The number of ICMP Echo Reply messages sent per second
573 [icmpOutEchoReps].
574 itm/s The number of ICMP Timestamp (request) messages received
576 per second [icmpInTimestamps].
577 itmr/s The number of ICMP Timestamp Reply messages received per
579 second [icmpInTimestampReps].
580 otm/s The number of ICMP Timestamp (request) messages sent per
582 second [icmpOutTimestamps].
583 otmr/s The number of ICMP Timestamp Reply messages sent per sec‐
585 ond [icmpOutTimestampReps].
586 iadrmk/s
588 The number of ICMP Address Mask Request messages received
589 per second [icmpInAddrMasks].
590 iadrmkr/s
592 The number of ICMP Address Mask Reply messages received
593 per second [icmpInAddrMaskReps].
594 oadrmk/s
596 The number of ICMP Address Mask Request messages sent per
597 second [icmpOutAddrMasks].
598 oadrmkr/s
600 The number of ICMP Address Mask Reply messages sent per
601 second [icmpOutAddrMaskReps].
602 With the EICMP keyword, statistics about ICMPv4 error messages
605 are reported. Note that ICMPv4 statistics depend on sadc's op‐
606 tion -S SNMP to be collected. The following values are dis‐
607 played (formal SNMP names between square brackets):
608 ierr/s The number of ICMP messages per second which the entity
610 received but determined as having ICMP-specific errors
611 (bad ICMP checksums, bad length, etc.) [icmpInErrors].
612 oerr/s The number of ICMP messages per second which this entity
614 did not send due to problems discovered within ICMP such
615 as a lack of buffers [icmpOutErrors].
616 idstunr/s
618 The number of ICMP Destination Unreachable messages re‐
619 ceived per second [icmpInDestUnreachs].
620 odstunr/s
622 The number of ICMP Destination Unreachable messages sent
623 per second [icmpOutDestUnreachs].
624 itmex/s
626 The number of ICMP Time Exceeded messages received per
627 second [icmpInTimeExcds].
628 otmex/s
630 The number of ICMP Time Exceeded messages sent per second
631 [icmpOutTimeExcds].
632 iparmpb/s
634 The number of ICMP Parameter Problem messages received
635 per second [icmpInParmProbs].
636 oparmpb/s
638 The number of ICMP Parameter Problem messages sent per
639 second [icmpOutParmProbs].
640 isrcq/s
642 The number of ICMP Source Quench messages received per
643 second [icmpInSrcQuenchs].
644 osrcq/s
646 The number of ICMP Source Quench messages sent per second
647 [icmpOutSrcQuenchs].
648 iredir/s
650 The number of ICMP Redirect messages received per second
651 [icmpInRedirects].
652 oredir/s
654 The number of ICMP Redirect messages sent per second
655 [icmpOutRedirects].
656 With the ICMP6 keyword, statistics about ICMPv6 network traffic
659 are reported. Note that ICMPv6 statistics depend on sadc's op‐
660 tion -S IPV6 to be collected. The following values are dis‐
661 played (formal SNMP names between square brackets):
662 imsg6/s
664 The total number of ICMP messages received by the inter‐
665 face per second which includes all those counted by
666 ierr6/s [ipv6IfIcmpInMsgs].
667 omsg6/s
669 The total number of ICMP messages which this interface
670 attempted to send per second [ipv6IfIcmpOutMsgs].
671 iech6/s
673 The number of ICMP Echo (request) messages received by
674 the interface per second [ipv6IfIcmpInEchos].
675 iechr6/s
677 The number of ICMP Echo Reply messages received by the
678 interface per second [ipv6IfIcmpInEchoReplies].
679 oechr6/s
681 The number of ICMP Echo Reply messages sent by the inter‐
682 face per second [ipv6IfIcmpOutEchoReplies].
683 igmbq6/s
685 The number of ICMPv6 Group Membership Query messages re‐
686 ceived by the interface per second [ipv6IfIcmpInGroupMem‐
687 bQueries].
688 igmbr6/s
690 The number of ICMPv6 Group Membership Response messages
691 received by the interface per second [ipv6IfIcmpInGroup‐
692 MembResponses].
693 ogmbr6/s
695 The number of ICMPv6 Group Membership Response messages
696 sent per second [ipv6IfIcmpOutGroupMembResponses].
697 igmbrd6/s
699 The number of ICMPv6 Group Membership Reduction messages
700 received by the interface per second [ipv6IfIcmpInGroup‐
701 MembReductions].
702 ogmbrd6/s
704 The number of ICMPv6 Group Membership Reduction messages
705 sent per second [ipv6IfIcmpOutGroupMembReductions].
706 irtsol6/s
708 The number of ICMP Router Solicit messages received by
709 the interface per second [ipv6IfIcmpInRouterSolicits].
710 ortsol6/s
712 The number of ICMP Router Solicitation messages sent by
713 the interface per second [ipv6IfIcmpOutRouterSolicits].
714 irtad6/s
716 The number of ICMP Router Advertisement messages received
717 by the interface per second [ipv6IfIcmpInRouterAdvertise‐
718 ments].
719 inbsol6/s
721 The number of ICMP Neighbor Solicit messages received by
722 the interface per second [ipv6IfIcmpInNeighborSolicits].
723 onbsol6/s
725 The number of ICMP Neighbor Solicitation messages sent by
726 the interface per second [ipv6IfIcmpOutNeighborSolicits].
727 inbad6/s
729 The number of ICMP Neighbor Advertisement messages re‐
730 ceived by the interface per second [ipv6IfIcmpInNeighbo‐
731 rAdvertisements].
732 onbad6/s
734 The number of ICMP Neighbor Advertisement messages sent
735 by the interface per second [ipv6IfIcmpOutNeighborAdver‐
736 tisements].
737 With the EICMP6 keyword, statistics about ICMPv6 error messages
740 are reported. Note that ICMPv6 statistics depend on sadc's op‐
741 tion -S IPV6 to be collected. The following values are dis‐
742 played (formal SNMP names between square brackets):
743 ierr6/s
745 The number of ICMP messages per second which the inter‐
746 face received but determined as having ICMP-specific er‐
747 rors (bad ICMP checksums, bad length, etc.)
748 [ipv6IfIcmpInErrors]
749 idtunr6/s
751 The number of ICMP Destination Unreachable messages re‐
752 ceived by the interface per second [ipv6IfIcmpInDestUn‐
753 reachs].
754 odtunr6/s
756 The number of ICMP Destination Unreachable messages sent
757 by the interface per second [ipv6IfIcmpOutDestUnreachs].
758 itmex6/s
760 The number of ICMP Time Exceeded messages received by the
761 interface per second [ipv6IfIcmpInTimeExcds].
762 otmex6/s
764 The number of ICMP Time Exceeded messages sent by the in‐
765 terface per second [ipv6IfIcmpOutTimeExcds].
766 iprmpb6/s
768 The number of ICMP Parameter Problem messages received by
769 the interface per second [ipv6IfIcmpInParmProblems].
770 oprmpb6/s
772 The number of ICMP Parameter Problem messages sent by the
773 interface per second [ipv6IfIcmpOutParmProblems].
774 iredir6/s
776 The number of Redirect messages received by the interface
777 per second [ipv6IfIcmpInRedirects].
778 oredir6/s
780 The number of Redirect messages sent by the interface by
781 second [ipv6IfIcmpOutRedirects].
782 ipck2b6/s
784 The number of ICMP Packet Too Big messages received by
785 the interface per second [ipv6IfIcmpInPktTooBigs].
786 opck2b6/s
788 The number of ICMP Packet Too Big messages sent by the
789 interface per second [ipv6IfIcmpOutPktTooBigs].
790 With the IP keyword, statistics about IPv4 network traffic are
793 reported. Note that IPv4 statistics depend on sadc's option -S
794 SNMP to be collected. The following values are displayed (for‐
795 mal SNMP names between square brackets):
796 irec/s The total number of input datagrams received from inter‐
798 faces per second, including those received in error [ip‐
799 InReceives].
800 fwddgm/s
802 The number of input datagrams per second, for which this
803 entity was not their final IP destination, as a result of
804 which an attempt was made to find a route to forward them
805 to that final destination [ipForwDatagrams].
806 idel/s The total number of input datagrams successfully deliv‐
808 ered per second to IP user-protocols (including ICMP)
809 [ipInDelivers].
810 orq/s The total number of IP datagrams which local IP user-pro‐
812 tocols (including ICMP) supplied per second to IP in re‐
813 quests for transmission [ipOutRequests]. Note that this
814 counter does not include any datagrams counted in fwd‐
815 dgm/s.
816 asmrq/s
818 The number of IP fragments received per second which
819 needed to be reassembled at this entity [ipReasmReqds].
820 asmok/s
822 The number of IP datagrams successfully re-assembled per
823 second [ipReasmOKs].
824 fragok/s
826 The number of IP datagrams that have been successfully
827 fragmented at this entity per second [ipFragOKs].
828 fragcrt/s
830 The number of IP datagram fragments that have been gener‐
831 ated per second as a result of fragmentation at this en‐
832 tity [ipFragCreates].
833 With the EIP keyword, statistics about IPv4 network errors are
836 reported. Note that IPv4 statistics depend on sadc's option -S
837 SNMP to be collected. The following values are displayed (for‐
838 mal SNMP names between square brackets):
839 ihdrerr/s
841 The number of input datagrams discarded per second due to
842 errors in their IP headers, including bad checksums, ver‐
843 sion number mismatch, other format errors, time-to-live
844 exceeded, errors discovered in processing their IP op‐
845 tions, etc. [ipInHdrErrors]
846 iadrerr/s
848 The number of input datagrams discarded per second be‐
849 cause the IP address in their IP header's destination
850 field was not a valid address to be received at this en‐
851 tity. This count includes invalid addresses (e.g.,
852 0.0.0.0) and addresses of unsupported Classes (e.g.,
853 Class E). For entities which are not IP routers and
854 therefore do not forward datagrams, this counter includes
855 datagrams discarded because the destination address was
856 not a local address [ipInAddrErrors].
857 iukwnpr/s
859 The number of locally-addressed datagrams received suc‐
860 cessfully but discarded per second because of an unknown
861 or unsupported protocol [ipInUnknownProtos].
862 idisc/s
864 The number of input IP datagrams per second for which no
865 problems were encountered to prevent their continued pro‐
866 cessing, but which were discarded (e.g., for lack of buf‐
867 fer space) [ipInDiscards]. Note that this counter does
868 not include any datagrams discarded while awaiting re-as‐
869 sembly.
870 odisc/s
872 The number of output IP datagrams per second for which no
873 problem was encountered to prevent their transmission to
874 their destination, but which were discarded (e.g., for
875 lack of buffer space) [ipOutDiscards]. Note that this
876 counter would include datagrams counted in fwddgm/s if
877 any such packets met this (discretionary) discard crite‐
878 rion.
879 onort/s
881 The number of IP datagrams discarded per second because
882 no route could be found to transmit them to their desti‐
883 nation [ipOutNoRoutes]. Note that this counter includes
884 any packets counted in fwddgm/s which meet this 'no-
885 route' criterion. Note that this includes any datagrams
886 which a host cannot route because all of its default
887 routers are down.
888 asmf/s The number of failures detected per second by the IP re-
890 assembly algorithm (for whatever reason: timed out, er‐
891 rors, etc) [ipReasmFails]. Note that this is not neces‐
892 sarily a count of discarded IP fragments since some algo‐
893 rithms can lose track of the number of fragments by com‐
894 bining them as they are received.
895 fragf/s
897 The number of IP datagrams that have been discarded per
898 second because they needed to be fragmented at this en‐
899 tity but could not be, e.g., because their Don't Fragment
900 flag was set [ipFragFails].
901 With the IP6 keyword, statistics about IPv6 network traffic are
904 reported. Note that IPv6 statistics depend on sadc's option -S
905 IPV6 to be collected. The following values are displayed (for‐
906 mal SNMP names between square brackets):
907 irec6/s
909 The total number of input datagrams received from inter‐
910 faces per second, including those received in error
911 [ipv6IfStatsInReceives].
912 fwddgm6/s
914 The number of output datagrams per second which this en‐
915 tity received and forwarded to their final destinations
916 [ipv6IfStatsOutForwDatagrams].
917 idel6/s
919 The total number of datagrams successfully delivered per
920 second to IPv6 user-protocols (including ICMP) [ipv6IfS‐
921 tatsInDelivers].
922 orq6/s The total number of IPv6 datagrams which local IPv6 user-
924 protocols (including ICMP) supplied per second to IPv6 in
925 requests for transmission [ipv6IfStatsOutRequests]. Note
926 that this counter does not include any datagrams counted
927 in fwddgm6/s.
928 asmrq6/s
930 The number of IPv6 fragments received per second which
931 needed to be reassembled at this interface [ipv6IfStat‐
932 sReasmReqds].
933 asmok6/s
935 The number of IPv6 datagrams successfully reassembled per
936 second [ipv6IfStatsReasmOKs].
937 imcpck6/s
939 The number of multicast packets received per second by
940 the interface [ipv6IfStatsInMcastPkts].
941 omcpck6/s
943 The number of multicast packets transmitted per second by
944 the interface [ipv6IfStatsOutMcastPkts].
945 fragok6/s
947 The number of IPv6 datagrams that have been successfully
948 fragmented at this output interface per second [ipv6IfS‐
949 tatsOutFragOKs].
950 fragcr6/s
952 The number of output datagram fragments that have been
953 generated per second as a result of fragmentation at this
954 output interface [ipv6IfStatsOutFragCreates].
955 With the EIP6 keyword, statistics about IPv6 network errors are
958 reported. Note that IPv6 statistics depend on sadc's option -S
959 IPV6 to be collected. The following values are displayed (for‐
960 mal SNMP names between square brackets):
961 ihdrer6/s
963 The number of input datagrams discarded per second due to
964 errors in their IPv6 headers, including version number
965 mismatch, other format errors, hop count exceeded, errors
966 discovered in processing their IPv6 options, etc.
967 [ipv6IfStatsInHdrErrors]
968 iadrer6/s
970 The number of input datagrams discarded per second be‐
971 cause the IPv6 address in their IPv6 header's destination
972 field was not a valid address to be received at this en‐
973 tity. This count includes invalid addresses (e.g., ::0)
974 and unsupported addresses (e.g., addresses with unallo‐
975 cated prefixes). For entities which are not IPv6 routers
976 and therefore do not forward datagrams, this counter in‐
977 cludes datagrams discarded because the destination ad‐
978 dress was not a local address [ipv6IfStatsInAddrErrors].
979 iukwnp6/s
981 The number of locally-addressed datagrams received suc‐
982 cessfully but discarded per second because of an unknown
983 or unsupported protocol [ipv6IfStatsInUnknownProtos].
984 i2big6/s
986 The number of input datagrams that could not be forwarded
987 per second because their size exceeded the link MTU of
988 outgoing interface [ipv6IfStatsInTooBigErrors].
989 idisc6/s
991 The number of input IPv6 datagrams per second for which
992 no problems were encountered to prevent their continued
993 processing, but which were discarded (e.g., for lack of
994 buffer space) [ipv6IfStatsInDiscards]. Note that this
995 counter does not include any datagrams discarded while
996 awaiting re-assembly.
997 odisc6/s
999 The number of output IPv6 datagrams per second for which
1000 no problem was encountered to prevent their transmission
1001 to their destination, but which were discarded (e.g., for
1002 lack of buffer space) [ipv6IfStatsOutDiscards]. Note that
1003 this counter would include datagrams counted in fwddgm6/s
1004 if any such packets met this (discretionary) discard cri‐
1005 terion.
1006 inort6/s
1008 The number of input datagrams discarded per second be‐
1009 cause no route could be found to transmit them to their
1010 destination [ipv6IfStatsInNoRoutes].
1011 onort6/s
1013 The number of locally generated IP datagrams discarded
1014 per second because no route could be found to transmit
1015 them to their destination [unknown formal SNMP name].
1016 asmf6/s
1018 The number of failures detected per second by the IPv6
1019 re-assembly algorithm (for whatever reason: timed out,
1020 errors, etc.) [ipv6IfStatsReasmFails]. Note that this is
1021 not necessarily a count of discarded IPv6 fragments since
1022 some algorithms can lose track of the number of fragments
1023 by combining them as they are received.
1024 fragf6/s
1026 The number of IPv6 datagrams that have been discarded per
1027 second because they needed to be fragmented at this out‐
1028 put interface but could not be [ipv6IfStatsOutFragFails].
1029 itrpck6/s
1031 The number of input datagrams discarded per second be‐
1032 cause datagram frame didn't carry enough data [ipv6IfS‐
1033 tatsInTruncatedPkts].
1034 With the NFS keyword, statistics about NFS client activity are
1037 reported. The following values are displayed:
1038 call/s Number of RPC requests made per second.
1040 retrans/s
1042 Number of RPC requests per second, those which needed to
1043 be retransmitted (for example because of a server time‐
1044 out).
1045 read/s Number of 'read' RPC calls made per second.
1047 write/s
1049 Number of 'write' RPC calls made per second.
1050 access/s
1052 Number of 'access' RPC calls made per second.
1053 getatt/s
1055 Number of 'getattr' RPC calls made per second.
1056 With the NFSD keyword, statistics about NFS server activity are
1059 reported. The following values are displayed:
1060 scall/s
1062 Number of RPC requests received per second.
1063 badcall/s
1065 Number of bad RPC requests received per second, those
1066 whose processing generated an error.
1067 packet/s
1069 Number of network packets received per second.
1070 udp/s Number of UDP packets received per second.
1072 tcp/s Number of TCP packets received per second.
1074 hit/s Number of reply cache hits per second.
1076 miss/s Number of reply cache misses per second.
1078 sread/s
1080 Number of 'read' RPC calls received per second.
1081 swrite/s
1083 Number of 'write' RPC calls received per second.
1084 saccess/s
1086 Number of 'access' RPC calls received per second.
1087 sgetatt/s
1089 Number of 'getattr' RPC calls received per second.
1090 With the SOCK keyword, statistics on sockets in use are reported
1093 (IPv4). The following values are displayed:
1094 totsck Total number of sockets used by the system.
1096 tcpsck Number of TCP sockets currently in use.
1098 udpsck Number of UDP sockets currently in use.
1100 rawsck Number of RAW sockets currently in use.
1102 ip-frag
1104 Number of IP fragments currently in queue.
1105 tcp-tw Number of TCP sockets in TIME_WAIT state.
1107 With the SOCK6 keyword, statistics on sockets in use are re‐
1110 ported (IPv6). Note that IPv6 statistics depend on sadc's op‐
1111 tion -S IPV6 to be collected. The following values are dis‐
1112 played:
1113 tcp6sck
1115 Number of TCPv6 sockets currently in use.
1116 udp6sck
1118 Number of UDPv6 sockets currently in use.
1119 raw6sck
1121 Number of RAWv6 sockets currently in use.
1122 ip6-frag
1124 Number of IPv6 fragments currently in use.
1125 With the SOFT keyword, statistics about software-based network
1128 processing are reported. The following values are displayed:
1129 total/s
1131 The total number of network frames processed per second.
1132 dropd/s
1134 The total number of network frames dropped per second be‐
1135 cause there was no room on the processing queue.
1136 squeezd/s
1138 The number of times the softirq handler function termi‐
1139 nated per second because its budget was consumed or the
1140 time limit was reached, but more work could have been
1141 done.
1142 rx_rps/s
1144 The number of times the CPU has been woken up per second
1145 to process packets via an inter-processor interrupt.
1146 flw_lim/s
1148 The number of times the flow limit has been reached per
1149 second. Flow limiting is an optional RPS feature that
1150 can be used to limit the number of packets queued to the
1151 backlog for each flow to a certain amount. This can help
1152 ensure that smaller flows are processed even though much
1153 larger flows are pushing packets in.
1154 blg_len
1156 The length of the network backlog.
1157 With the TCP keyword, statistics about TCPv4 network traffic are
1160 reported. Note that TCPv4 statistics depend on sadc's option -S
1161 SNMP to be collected. The following values are displayed (for‐
1162 mal SNMP names between square brackets):
1163 active/s
1165 The number of times TCP connections have made a direct
1166 transition to the SYN-SENT state from the CLOSED state
1167 per second [tcpActiveOpens].
1168 passive/s
1170 The number of times TCP connections have made a direct
1171 transition to the SYN-RCVD state from the LISTEN state
1172 per second [tcpPassiveOpens].
1173 iseg/s The total number of segments received per second, includ‐
1175 ing those received in error [tcpInSegs]. This count in‐
1176 cludes segments received on currently established connec‐
1177 tions.
1178 oseg/s The total number of segments sent per second, including
1180 those on current connections but excluding those contain‐
1181 ing only retransmitted octets [tcpOutSegs].
1182 With the ETCP keyword, statistics about TCPv4 network errors are
1185 reported. Note that TCPv4 statistics depend on sadc's option -S
1186 SNMP to be collected. The following values are displayed (for‐
1187 mal SNMP names between square brackets):
1188 atmptf/s
1190 The number of times per second TCP connections have made
1191 a direct transition to the CLOSED state from either the
1192 SYN-SENT state or the SYN-RCVD state, plus the number of
1193 times per second TCP connections have made a direct tran‐
1194 sition to the LISTEN state from the SYN-RCVD state [tc‐
1195 pAttemptFails].
1196 estres/s
1198 The number of times per second TCP connections have made
1199 a direct transition to the CLOSED state from either the
1200 ESTABLISHED state or the CLOSE-WAIT state [tcpEstabRe‐
1201 sets].
1202 retrans/s
1204 The total number of segments retransmitted per second -
1205 that is, the number of TCP segments transmitted contain‐
1206 ing one or more previously transmitted octets [tcpRe‐
1207 transSegs].
1208 isegerr/s
1210 The total number of segments received in error (e.g., bad
1211 TCP checksums) per second [tcpInErrs].
1212 orsts/s
1214 The number of TCP segments sent per second containing the
1215 RST flag [tcpOutRsts].
1216 With the UDP keyword, statistics about UDPv4 network traffic are
1219 reported. Note that UDPv4 statistics depend on sadc's option -S
1220 SNMP to be collected. The following values are displayed (for‐
1221 mal SNMP names between square brackets):
1222 idgm/s The total number of UDP datagrams delivered per second to
1224 UDP users [udpInDatagrams].
1225 odgm/s The total number of UDP datagrams sent per second from
1227 this entity [udpOutDatagrams].
1228 noport/s
1230 The total number of received UDP datagrams per second for
1231 which there was no application at the destination port
1232 [udpNoPorts].
1233 idgmerr/s
1235 The number of received UDP datagrams per second that
1236 could not be delivered for reasons other than the lack of
1237 an application at the destination port [udpInErrors].
1238 With the UDP6 keyword, statistics about UDPv6 network traffic
1241 are reported. Note that UDPv6 statistics depend on sadc's op‐
1242 tion -S IPV6 to be collected. The following values are dis‐
1243 played (formal SNMP names between square brackets):
1244 idgm6/s
1246 The total number of UDP datagrams delivered per second to
1247 UDP users [udpInDatagrams].
1248 odgm6/s
1250 The total number of UDP datagrams sent per second from
1251 this entity [udpOutDatagrams].
1252 noport6/s
1254 The total number of received UDP datagrams per second for
1255 which there was no application at the destination port
1256 [udpNoPorts].
1257 idgmer6/s
1259 The number of received UDP datagrams per second that
1260 could not be delivered for reasons other than the lack of
1261 an application at the destination port [udpInErrors].
1262 The ALL keyword is equivalent to specifying all the keywords
1265 above and therefore all the network activities are reported.
1266 -o [ filename ]
1268 Save the readings in the file in binary form. Each reading is in
1269 a separate record. The default value of the filename parameter
1270 is the current standard system activity daily data file. If
1271 filename is a directory instead of a plain file then it is con‐
1272 sidered as the directory where the standard system activity
1273 daily data files are located. Option -o is exclusive of option
1274 -f. All the data available from the kernel are saved in the
1275 file (in fact, sar calls its data collector sadc with the option
1276 -S ALL. See sadc(8) manual page).
1277 -P { cpu_list | ALL }
1279 Report per-processor statistics for the specified processor or
1280 processors. cpu_list is a list of comma-separated values or
1281 range of values (e.g., 0,2,4-7,12-). Note that processor 0 is
1282 the first processor, and processor all is the global average
1283 among all processors. Specifying the ALL keyword reports sta‐
1284 tistics for each individual processor, and globally for all pro‐
1285 cessors. Offline processors are not displayed.
1286 -p, --pretty
1288 Make reports easier to read by a human. This option may be es‐
1289 pecially useful when displaying e.g., network interfaces or
1290 block devices statistics.
1291 -q [ keyword[,...] | ALL ]
1293 Report system load and pressure-stall statistics.
1294 Possible keywords are CPU, IO, LOAD, MEM and PSI".
1296 With the CPU keyword, CPU pressure statistics are reported. The
1298 following values are displayed:
1299 %scpu-10
1301 Percentage of the time that at least some runnable tasks
1302 were delayed because the CPU was unavailable to them,
1303 over the last 10 second window.
1304 %scpu-60
1306 Percentage of the time that at least some runnable tasks
1307 were delayed because the CPU was unavailable to them,
1308 over the last 60 second window.
1309 %scpu-300
1311 Percentage of the time that at least some runnable tasks
1312 were delayed because the CPU was unavailable to them,
1313 over the last 300 second window.
1314 %scpu Percentage of the time that at least some runnable tasks
1316 were delayed because the CPU was unavailable to them,
1317 over the last time interval.
1318 With the IO keyword, I/O pressure statistics are reported. The
1321 following values are displayed:
1322 %sio-10
1324 Percentage of the time that at least some tasks lost
1325 waiting for I/O, over the last 10 second window.
1326 %sio-60
1328 Percentage of the time that at least some tasks lost
1329 waiting for I/O, over the last 60 second window.
1330 %sio-300
1332 Percentage of the time that at least some tasks lost
1333 waiting for I/O, over the last 300 second window.
1334 %sio Percentage of the time that at least some tasks lost
1336 waiting for I/O, over the last time interval.
1337 %fio-10
1339 Percentage of the time during which all non-idle tasks
1340 were stalled waiting for I/O, over the last 10 second
1341 window.
1342 %fio-60
1344 Percentage of the time during which all non-idle tasks
1345 were stalled waiting for I/O, over the last 60 second
1346 window.
1347 %fio-300
1349 Percentage of the time during which all non-idle tasks
1350 were stalled waiting for I/O, over the last 300 second
1351 window.
1352 %fio Percentage of the time during which all non-idle tasks
1354 were stalled waiting for I/O, over the last time inter‐
1355 val.
1356 With the LOAD keyword, queue length and load averages statistics
1359 are reported. The following values are displayed:
1360 runq-sz
1362 Run queue length (number of tasks running or waiting for
1363 run time).
1364 plist-sz
1366 Number of tasks in the task list.
1367 ldavg-1
1369 System load average for the last minute. The load aver‐
1370 age is calculated as the average number of runnable or
1371 running tasks (R state), and the number of tasks in unin‐
1372 terruptible sleep (D state) over the specified interval.
1373 ldavg-5
1375 System load average for the past 5 minutes.
1376 ldavg-15
1378 System load average for the past 15 minutes.
1379 blocked
1381 Number of tasks currently blocked, waiting for I/O to
1382 complete.
1383 With the MEM keyword, memory pressure statistics are reported.
1386 The following values are displayed:
1387 %smem-10
1389 Percentage of the time during which at least some tasks
1390 were waiting for memory resources, over the last 10 sec‐
1391 ond window.
1392 %smem-60
1394 Percentage of the time during which at least some tasks
1395 were waiting for memory resources, over the last 60 sec‐
1396 ond window.
1397 %smem-300
1399 Percentage of the time during which at least some tasks
1400 were waiting for memory resources, over the last 300 sec‐
1401 ond window.
1402 %smem Percentage of the time during which at least some tasks
1404 were waiting for memory resources, over the last time in‐
1405 terval.
1406 %fmem-10
1408 Percentage of the time during which all non-idle tasks
1409 were stalled waiting for memory resources, over the last
1410 10 second window.
1411 %fmem-60
1413 Percentage of the time during which all non-idle tasks
1414 were stalled waiting for memory resources, over the last
1415 60 second window.
1416 %fmem-300
1418 Percentage of the time during which all non-idle tasks
1419 were stalled waiting for memory resources, over the last
1420 300 second window.
1421 %fmem Percentage of the time during which all non-idle tasks
1423 were stalled waiting for memory resources, over the last
1424 time interval.
1425 The PSI keyword is equivalent to specifying CPU, IO and MEM key‐
1428 words together and therefore all the pressure-stall statistics
1429 are reported.
1430 The ALL keyword is equivalent to specifying all the keywords
1432 above and therefore all the statistics are reported.
1433 -r [ ALL ]
1435 Report memory utilization statistics. The ALL keyword indicates
1436 that all the memory fields should be displayed. The following
1437 values may be displayed:
1438 kbmemfree
1440 Amount of free memory available in kilobytes.
1441 kbavail
1443 Estimate of how much memory in kilobytes is available for
1444 starting new applications, without swapping. The esti‐
1445 mate takes into account that the system needs some page
1446 cache to function well, and that not all reclaimable slab
1447 will be reclaimable, due to items being in use. The im‐
1448 pact of those factors will vary from system to system.
1449 kbmemused
1451 Amount of used memory in kilobytes (calculated as total
1452 installed memory - kbmemfree - kbbuffers - kbcached - kb‐
1453 slab).
1454 %memused
1456 Percentage of used memory.
1457 kbbuffers
1459 Amount of memory used as buffers by the kernel in kilo‐
1460 bytes.
1461 kbcached
1463 Amount of memory used to cache data by the kernel in
1464 kilobytes.
1465 kbcommit
1467 Amount of memory in kilobytes needed for current work‐
1468 load. This is an estimate of how much RAM/swap is needed
1469 to guarantee that there never is out of memory.
1470 %commit
1472 Percentage of memory needed for current workload in rela‐
1473 tion to the total amount of memory (RAM+swap). This num‐
1474 ber may be greater than 100% because the kernel usually
1475 overcommits memory.
1476 kbactive
1478 Amount of active memory in kilobytes (memory that has
1479 been used more recently and usually not reclaimed unless
1480 absolutely necessary).
1481 kbinact
1483 Amount of inactive memory in kilobytes (memory which has
1484 been less recently used. It is more eligible to be re‐
1485 claimed for other purposes).
1486 kbdirty
1488 Amount of memory in kilobytes waiting to get written back
1489 to the disk.
1490 kbanonpg
1492 Amount of non-file backed pages in kilobytes mapped into
1493 userspace page tables.
1494 kbslab Amount of memory in kilobytes used by the kernel to cache
1496 data structures for its own use.
1497 kbkstack
1499 Amount of memory in kilobytes used for kernel stack
1500 space.
1501 kbpgtbl
1503 Amount of memory in kilobytes dedicated to the lowest
1504 level of page tables.
1505 kbvmused
1507 Amount of memory in kilobytes of used virtual address
1508 space.
1509 -S Report swap space utilization statistics. The following values
1511 are displayed:
1512 kbswpfree
1514 Amount of free swap space in kilobytes.
1515 kbswpused
1517 Amount of used swap space in kilobytes.
1518 %swpused
1520 Percentage of used swap space.
1521 kbswpcad
1523 Amount of cached swap memory in kilobytes. This is mem‐
1524 ory that once was swapped out, is swapped back in but
1525 still also is in the swap area (if memory is needed it
1526 doesn't need to be swapped out again because it is al‐
1527 ready in the swap area. This saves I/O).
1528 %swpcad
1530 Percentage of cached swap memory in relation to the
1531 amount of used swap space.
1532 -s [ hh:mm[:ss] ]
1534 Set the starting time of the data, causing the sar command to
1535 extract records time-tagged at, or following, the time speci‐
1536 fied. The default starting time is 08:00:00. Hours must be
1537 given in 24-hour format. This option can be used only when data
1538 are read from a file (option -f).
1539 --sadc Indicate which data collector is called by sar. If the data
1541 collector is sought in PATH then enter "which sadc" to know
1542 where it is located.
1543 -t When reading data from a daily data file, indicate that sar
1545 should display the timestamps in the original local time of the
1546 data file creator. Without this option, the sar command displays
1547 the timestamps in the user's locale time.
1548 -u [ ALL ]
1550 Report CPU utilization. The ALL keyword indicates that all the
1551 CPU fields should be displayed. The report may show the follow‐
1552 ing fields:
1553 %user Percentage of CPU utilization that occurred while execut‐
1555 ing at the user level (application). Note that this field
1556 includes time spent running virtual processors.
1557 %usr Percentage of CPU utilization that occurred while execut‐
1559 ing at the user level (application). Note that this field
1560 does NOT include time spent running virtual processors.
1561 %nice Percentage of CPU utilization that occurred while execut‐
1563 ing at the user level with nice priority.
1564 %system
1566 Percentage of CPU utilization that occurred while execut‐
1567 ing at the system level (kernel). Note that this field
1568 includes time spent servicing hardware and software in‐
1569 terrupts.
1570 %sys Percentage of CPU utilization that occurred while execut‐
1572 ing at the system level (kernel). Note that this field
1573 does NOT include time spent servicing hardware or soft‐
1574 ware interrupts.
1575 %iowait
1577 Percentage of time that the CPU or CPUs were idle during
1578 which the system had an outstanding disk I/O request.
1579 %steal Percentage of time spent in involuntary wait by the vir‐
1581 tual CPU or CPUs while the hypervisor was servicing an‐
1582 other virtual processor.
1583 %irq Percentage of time spent by the CPU or CPUs to service
1585 hardware interrupts.
1586 %soft Percentage of time spent by the CPU or CPUs to service
1588 software interrupts.
1589 %guest Percentage of time spent by the CPU or CPUs to run a vir‐
1591 tual processor.
1592 %gnice Percentage of time spent by the CPU or CPUs to run a
1594 niced guest.
1595 %idle Percentage of time that the CPU or CPUs were idle and the
1597 system did not have an outstanding disk I/O request.
1598 -V Print version number then exit.
1600 -v Report status of inode, file and other kernel tables. The fol‐
1602 lowing values are displayed:
1603 dentunusd
1605 Number of unused cache entries in the directory cache.
1606 file-nr
1608 Number of file handles used by the system.
1609 inode-nr
1611 Number of inode handlers used by the system.
1612 pty-nr Number of pseudo-terminals used by the system.
1614 -W Report swapping statistics. The following values are displayed:
1616 pswpin/s
1618 Total number of swap pages the system brought in per sec‐
1619 ond.
1620 pswpout/s
1622 Total number of swap pages the system brought out per
1623 second.
1624 -w Report task creation and system switching activity. The follow‐
1626 ing values are displayed:
1627 proc/s Total number of tasks created per second.
1629 cswch/s
1631 Total number of context switches per second.
1632 -y Report TTY devices activity. The following values are displayed:
1634 rcvin/s
1636 Number of receive interrupts per second for current se‐
1637 rial line. Serial line number is given in the TTY col‐
1638 umn.
1639 xmtin/s
1641 Number of transmit interrupts per second for current se‐
1642 rial line.
1643 framerr/s
1645 Number of frame errors per second for current serial
1646 line.
1647 prtyerr/s
1649 Number of parity errors per second for current serial
1650 line.
1651 brk/s Number of breaks per second for current serial line.
1653 ovrun/s
1655 Number of overrun errors per second for current serial
1656 line.
1657 -z Tell sar to omit output for any devices for which there was no
1659 activity during the sample period.
1660
1663 The sar command takes into account the following environment variables:
1664 S_COLORS
1666 By default statistics are displayed in color when the output is
1667 connected to a terminal. Use this variable to change the set‐
1668 tings. Possible values for this variable are never, always or
1669 auto (the latter is equivalent to the default settings).
1670 Please note that the color (being red, yellow, or some other
1671 color) used to display a value is not indicative of any kind of
1672 issue simply because of the color. It only indicates different
1673 ranges of values.
1674 S_COLORS_SGR
1676 Specify the colors and other attributes used to display statis‐
1677 tics on the terminal. Its value is a colon-separated list of
1678 capabilities that defaults to
1679 C=33;22:H=31;1:I=32;22:M=35;1:N=34;1:R=31;22:Z=34;22. Supported
1680 capabilities are:
1681 C= SGR (Select Graphic Rendition) substring for comments in‐
1683 serted in the binary daily data files.
1684 H= SGR substring for percentage values greater than or equal
1686 to 75%.
1687 I= SGR substring for item names or values (eg. network in‐
1689 terfaces, CPU number...)
1690 M= SGR substring for percentage values in the range from 50%
1692 to 75%.
1693 N= SGR substring for non-zero statistics values.
1695 R= SGR substring for restart messages.
1697 Z= SGR substring for zero values.
1699 S_TIME_DEF_TIME
1701 If this variable exists and its value is UTC then sar will save
1702 its data in UTC time (data will still be displayed in local
1703 time). sar will also use UTC time instead of local time to de‐
1704 termine the current daily data file located in the /var/log/sa
1705 directory. This variable may be useful for servers with users
1706 located across several timezones.
1707 S_TIME_FORMAT
1709 If this variable exists and its value is ISO then the current
1710 locale will be ignored when printing the date in the report
1711 header. The sar command will use the ISO 8601 format (YYYY-MM-
1712 DD) instead. The timestamp will also be compliant with ISO 8601
1713 format.
1714
1717 sar -u 2 5
1718 Report CPU utilization for each 2 seconds. 5 lines are dis‐
1719 played.
1720 sar -I 14 -o int14.file 2 10
1722 Report statistics on IRQ 14 for each 2 seconds. 10 lines are
1723 displayed. Data are stored in a file called int14.file.
1724 sar -r -n DEV -f /var/log/sa/sa16
1726 Display memory and network statistics saved in daily data file
1727 sa16.
1728 sar -A Display all the statistics saved in current daily data file.
1730
1733 /proc filesystem must be mounted for the sar command to work.
1734 All the statistics are not necessarily available, depending on the ker‐
1736 nel version used. sar assumes that you are using at least a 2.6 ker‐
1737 nel.
1738 Although sar speaks of kilobytes (kB), megabytes (MB)..., it actually
1740 uses kibibytes (kiB), mebibytes (MiB)... A kibibyte is equal to 1024
1741 bytes, and a mebibyte is equal to 1024 kibibytes.
1742
1745 /var/log/sa/saDD
1746 /var/log/sa/saYYYYMMDD
1747 The standard system activity daily data files and their default
1748 location. YYYY stands for the current year, MM for the current
1749 month and DD for the current day.
1750 /proc and /sys contain various files with system statistics.
1752
1755 Sebastien Godard (sysstat <at> orange.fr)
1756
1759 sadc(8), sa1(8), sa2(8), sadf(1), sysstat(5), pidstat(1), mpstat(1),
1760 iostat(1), vmstat(8)
1761 https://github.com/sysstat/sysstat
1763 http://pagesperso-orange.fr/sebastien.godard/
1764Linux MARCH 2022 SAR(1)