1SAR(1) Linux User's Manual SAR(1)
2
6 sar - Collect, report, or save system activity information.
7
10 sar [ -A ] [ -B ] [ -b ] [ -C ] [ -D ] [ -d ] [ -F [ MOUNT ] ] [ -H ] [
11 -h ] [ -p ] [ -r [ ALL ] ] [ -S ] [ -t ] [ -u [ ALL ] ] [ -V ] [ -v ] [
12 -W ] [ -w ] [ -x ] [ -y ] [ -z ] [ --dec={ 0 | 1 | 2 } ] [
13 --dev=dev_list ] [ --fs=fs_list ] [ --help ] [ --human ] [
14 --iface=iface_list ] [ --int=int_list ] [ --pretty ] [ --sadc ] [ -I [
15 SUM | ALL ] ] [ -P { cpu_list | ALL } ] [ -m { keyword[,...] | ALL } ]
16 [ -n { keyword[,...] | ALL } ] [ -q [ keyword[,...] | ALL ] ] [ -j {
17 SID | ID | LABEL | PATH | UUID | ... } ] [ -f [ filename ] | -o [ file‐
18 name ] | -[0-9]+ ] [ -i interval ] [ -s [ start_time ] ] [ -e [
19 end_time ] ] ] [ interval [ count ] ]
20
23 The sar command writes to standard output the contents of selected cu‐
24 mulative activity counters in the operating system. The accounting sys‐
25 tem, based on the values in the count and interval parameters, writes
26 information the specified number of times spaced at the specified in‐
27 tervals in seconds. If the interval parameter is set to zero, the sar
28 command displays the average statistics for the time since the system
29 was started. If the interval parameter is specified without the count
30 parameter, then reports are generated continuously. The collected data
31 can also be saved in the file specified by the -o filename flag, in ad‐
32 dition to being displayed onto the screen. If filename is omitted, sar
33 uses the standard system activity daily data file (see below). By de‐
34 fault all the data available from the kernel are saved in the data
35 file.
36 The sar command extracts and writes to standard output records previ‐
38 ously saved in a file. This file can be either the one specified by the
39 -f flag or, by default, the standard system activity daily data file.
40 It is also possible to enter -1, -2 etc. as an argument to sar to dis‐
41 play data of that days ago. For example, -1 will point at the standard
42 system activity file of yesterday.
43 Standard system activity daily data files are named saDD or saYYYYMMDD,
45 where YYYY stands for the current year, MM for the current month and DD
46 for the current day. They are the default files used by sar only when
47 no filename has been explicitly specified. When used to write data to
48 files (with its option -o), sar will use saYYYYMMDD if option -D has
49 also been specified, else it will use saDD. When used to display the
50 records previously saved in a file, sar will look for the most recent
51 of saDD and saYYYYMMDD, and use it.
52 Standard system activity daily data files are located in the
54 /var/log/sa directory by default. Yet it is possible to specify an al‐
55 ternate location for them: If a directory (instead of a plain file) is
56 used with options -f or -o then it will be considered as the directory
57 containing the data files.
58 Without the -P flag, the sar command reports system-wide (global among
60 all processors) statistics, which are calculated as averages for values
61 expressed as percentages, and as sums otherwise. If the -P flag is
62 given, the sar command reports activity which relates to the specified
63 processor or processors. If -P ALL is given, the sar command reports
64 statistics for each individual processor and global statistics among
65 all processors. Offline processors are not displayed.
66 You can select information about specific system activities using
68 flags. Not specifying any flags selects only CPU activity. Specifying
69 the -A flag selects all possible activities.
70 The default version of the sar command (CPU utilization report) might
72 be one of the first facilities the user runs to begin system activity
73 investigation, because it monitors major system resources. If CPU uti‐
74 lization is near 100 percent (user + nice + system), the workload sam‐
75 pled is CPU-bound.
76 If multiple samples and multiple reports are desired, it is convenient
78 to specify an output file for the sar command. Run the sar command as a
79 background process. The syntax for this is:
80 sar -o datafile interval count >/dev/null 2>&1 &
82 All data are captured in binary form and saved to a file (datafile).
84 The data can then be selectively displayed with the sar command using
85 the -f option. Set the interval and count parameters to select count
86 records at interval second intervals. If the count parameter is not
87 set, all the records saved in the file will be selected. Collection of
88 data in this manner is useful to characterize system usage over a pe‐
89 riod of time and determine peak usage hours.
90 Note: The sar command only reports on local activities.
92
95 -A This is equivalent to specifying -bBdFHISvwWy -m ALL -n ALL -q
96 ALL -r ALL -u ALL. This option also implies specifying -I ALL
97 -P ALL unless these options are explicitly set on the command
98 line.
99 -B Report paging statistics. The following values are displayed:
101 pgpgin/s
103 Total number of kilobytes the system paged in from disk
104 per second.
105 pgpgout/s
107 Total number of kilobytes the system paged out to disk
108 per second.
109 fault/s
111 Number of page faults (major + minor) made by the system
112 per second. This is not a count of page faults that gen‐
113 erate I/O, because some page faults can be resolved with‐
114 out I/O.
115 majflt/s
117 Number of major faults the system has made per second,
118 those which have required loading a memory page from
119 disk.
120 pgfree/s
122 Number of pages placed on the free list by the system per
123 second.
124 pgscank/s
126 Number of pages scanned by the kswapd daemon per second.
127 pgscand/s
129 Number of pages scanned directly per second.
130 pgsteal/s
132 Number of pages the system has reclaimed from cache
133 (pagecache and swapcache) per second to satisfy its mem‐
134 ory demands.
135 %vmeff Calculated as pgsteal / pgscan, this is a metric of the
137 efficiency of page reclaim. If it is near 100% then al‐
138 most every page coming off the tail of the inactive list
139 is being reaped. If it gets too low (e.g. less than 30%)
140 then the virtual memory is having some difficulty. This
141 field is displayed as zero if no pages have been scanned
142 during the interval of time.
143 -b Report I/O and transfer rate statistics. The following values
145 are displayed:
146 tps Total number of transfers per second that were issued to
148 physical devices. A transfer is an I/O request to a
149 physical device. Multiple logical requests can be com‐
150 bined into a single I/O request to the device. A trans‐
151 fer is of indeterminate size.
152 rtps Total number of read requests per second issued to physi‐
154 cal devices.
155 wtps Total number of write requests per second issued to phys‐
157 ical devices.
158 dtps Total number of discard requests per second issued to
160 physical devices.
161 bread/s
163 Total amount of data read from the devices in blocks per
164 second. Blocks are equivalent to sectors and therefore
165 have a size of 512 bytes.
166 bwrtn/s
168 Total amount of data written to devices in blocks per
169 second.
170 bdscd/s
172 Total amount of data discarded for devices in blocks per
173 second.
174 -C When reading data from a file, tell sar to display comments that
176 have been inserted by sadc.
177 -D Use saYYYYMMDD instead of saDD as the standard system activity
179 daily data file name. This option works only when used in con‐
180 junction with option -o to save data to file.
181 -d Report activity for each block device. When data are displayed,
183 the device name is displayed as it (should) appear in /dev. sar
184 uses data in /sys to determine the device name based on its ma‐
185 jor and minor numbers. If this name resolution fails, sar will
186 use name mapping controlled by /etc/sysconfig/sysstat.ioconf
187 file. Persistent device names can also be printed if option -j
188 is used (see below). Statistics for all devices are displayed
189 unless a restricted list is specified using option --dev= (see
190 corresponding option entry). Note that disk activity depends on
191 sadc's options -S DISK and -S XDISK to be collected. The follow‐
192 ing values are displayed:
193 tps Total number of transfers per second that were issued to
195 physical devices. A transfer is an I/O request to a
196 physical device. Multiple logical requests can be com‐
197 bined into a single I/O request to the device. A trans‐
198 fer is of indeterminate size.
199 rkB/s Number of kilobytes read from the device per second.
201 wkB/s Number of kilobytes written to the device per second.
203 dkB/s Number of kilobytes discarded for the device per second.
205 areq-sz
207 The average size (in kilobytes) of the I/O requests that
208 were issued to the device.
209 Note: In previous versions, this field was known as av‐
210 grq-sz and was expressed in sectors.
211 aqu-sz The average queue length of the requests that were issued
213 to the device.
214 Note: In previous versions, this field was known as
215 avgqu-sz.
216 await The average time (in milliseconds) for I/O requests is‐
218 sued to the device to be served. This includes the time
219 spent by the requests in queue and the time spent servic‐
220 ing them.
221 %util Percentage of elapsed time during which I/O requests were
223 issued to the device (bandwidth utilization for the de‐
224 vice). Device saturation occurs when this value is close
225 to 100% for devices serving requests serially. But for
226 devices serving requests in parallel, such as RAID arrays
227 and modern SSDs, this number does not reflect their per‐
228 formance limits.
229 --dec={ 0 | 1 | 2 }
231 Specify the number of decimal places to use (0 to 2, default
232 value is 2).
233 --dev=dev_list
235 Specify the block devices for which statistics are to be dis‐
236 played by sar. dev_list is a list of comma-separated device
237 names.
238 -e [ hh:mm[:ss] ]
240 -e [ seconds_since_the_epoch ]
241 Set the ending time of the report. The default ending time is
242 18:00:00. Hours must be given in 24-hour format, or as the num‐
243 ber of seconds since the epoch (given as a 10 digit number).
244 This option can be used when data are read from or written to a
245 file (options -f or -o).
246 -F [ MOUNT ]
248 Display statistics for currently mounted filesystems. Pseudo-
249 filesystems are ignored. At the end of the report, sar will dis‐
250 play a summary of all those filesystems. Use of the MOUNT param‐
251 eter keyword indicates that mountpoint will be reported instead
252 of filesystem device. Statistics for all filesystems are dis‐
253 played unless a restricted list is specified using option --fs=
254 (see corresponding option entry). Note that filesystems statis‐
255 tics depend on sadc's option -S XDISK to be collected.
256 The following values are displayed:
258 MBfsfree
260 Total amount of free space in megabytes (including space
261 available only to privileged user).
262 MBfsused
264 Total amount of space used in megabytes.
265 %fsused
267 Percentage of filesystem space used, as seen by a privi‐
268 leged user.
269 %ufsused
271 Percentage of filesystem space used, as seen by an un‐
272 privileged user.
273 Ifree Total number of free file nodes in filesystem.
275 Iused Total number of file nodes used in filesystem.
277 %Iused Percentage of file nodes used in filesystem.
279 -f [ filename ]
281 Extract records from filename (created by the -o filename flag).
282 The default value of the filename parameter is the current stan‐
283 dard system activity daily data file. If filename is a directory
284 instead of a plain file then it is considered as the directory
285 where the standard system activity daily data files are located.
286 Option -f is exclusive of option -o.
287 --fs=fs_list
289 Specify the filesystems for which statistics are to be displayed
290 by sar. fs_list is a list of comma-separated filesystem names
291 or mountpoints.
292 -H Report hugepages utilization statistics. The following values
294 are displayed:
295 kbhugfree
297 Amount of hugepages memory in kilobytes that is not yet
298 allocated.
299 kbhugused
301 Amount of hugepages memory in kilobytes that has been al‐
302 located.
303 %hugused
305 Percentage of total hugepages memory that has been allo‐
306 cated.
307 kbhugrsvd
309 Amount of reserved hugepages memory in kilobytes.
310 kbhugsurp
312 Amount of surplus hugepages memory in kilobytes.
313 -h This option is equivalent to specifying --pretty --human.
315 --help Display a short help message then exit.
317 --human
319 Print sizes in human readable format (e.g. 1.0k, 1.2M, etc.)
320 The units displayed with this option supersede any other default
321 units (e.g. kilobytes, sectors...) associated with the metrics.
322 -I [ SUM | ALL ]
324 Report statistics for interrupts. The values displayed are the
325 number of interrupts per second for the given processor or among
326 all processors. A list of interrupts can be specified using
327 --int= (see this option). The SUM keyword indicates that the to‐
328 tal number of interrupts received per second is to be displayed.
329 The ALL keyword indicates that statistics from all interrupts
330 are to be reported (this is the default). Note that interrupts
331 statistics depend on sadc's option -S INT to be collected.
332 -i interval
334 Select data records at seconds as close as possible to the num‐
335 ber specified by the interval parameter.
336 --iface=iface_list
338 Specify the network interfaces for which statistics are to be
339 displayed by sar. iface_list is a list of comma-separated in‐
340 terface names.
341 --int=int_list
343 Specify the interrupts names for which statistics are to be dis‐
344 played by sar. int_list is a list of comma-separated values or
345 range of values (e.g., 0-16,35,40-).
346 -j { SID | ID | LABEL | PATH | UUID | ... }
348 Display persistent device names. Use this option in conjunction
349 with option -d. Keywords ID, LABEL, etc. specify the type of the
350 persistent name. These keywords are not limited, only prerequi‐
351 site is that directory with required persistent names is present
352 in /dev/disk. Keyword SID tries to get a stable identifier to
353 use as the device name. A stable identifier won't change across
354 reboots for the same physical device. If it exists, this identi‐
355 fier is normally the WWN (World Wide Name) of the device, as
356 read from the /dev/disk/by-id directory.
357 -m { keyword[,...] | ALL }
359 Report power management statistics. Note that these statistics
360 depend on sadc's option -S POWER to be collected.
361 Possible keywords are BAT, CPU, FAN, FREQ, IN, TEMP and USB.
363 With the BAT keyword, statistics about batteries capacity are
365 reported. The following values are displayed:
366 %cap Battery capacity.
368 cap/min
370 Capacity lost or gained per minute by the battery.
371 status Charging status of the battery: ↑ (full), ↗ (charging), →
373 (not charging), ↘ (discharging), ? (unknown).
374 With the CPU keyword, statistics about CPU are reported. The
377 following value is displayed:
378 MHz Instantaneous CPU clock frequency in MHz.
380 With the FAN keyword, statistics about fans speed are reported.
383 The following values are displayed:
384 rpm Fan speed expressed in revolutions per minute.
386 drpm This field is calculated as the difference between cur‐
388 rent fan speed (rpm) and its low limit (fan_min).
389 DEVICE Sensor device name.
391 With the FREQ keyword, statistics about CPU clock frequency are
394 reported. The following value is displayed:
395 wghMHz Weighted average CPU clock frequency in MHz. Note that
397 the cpufreq-stats driver must be compiled in the kernel
398 for this option to work.
399 With the IN keyword, statistics about voltage inputs are re‐
402 ported. The following values are displayed:
403 inV Voltage input expressed in Volts.
405 %in Relative input value. A value of 100% means that voltage
407 input has reached its high limit (in_max) whereas a value
408 of 0% means that it has reached its low limit (in_min).
409 DEVICE Sensor device name.
411 With the TEMP keyword, statistics about devices temperature are
414 reported. The following values are displayed:
415 degC Device temperature expressed in degrees Celsius.
417 %temp Relative device temperature. A value of 100% means that
419 temperature has reached its high limit (temp_max).
420 DEVICE Sensor device name.
422 With the USB keyword, the sar command takes a snapshot of all
425 the USB devices currently plugged into the system. At the end of
426 the report, sar will display a summary of all those USB devices.
427 The following values are displayed:
428 BUS Root hub number of the USB device.
430 idvendor
432 Vendor ID number (assigned by USB organization).
433 idprod Product ID number (assigned by Manufacturer).
435 maxpower
437 Maximum power consumption of the device (expressed in
438 mA).
439 manufact
441 Manufacturer name.
442 product
444 Product name.
445 The ALL keyword is equivalent to specifying all the keywords
448 above and therefore all the power management statistics are re‐
449 ported.
450 -n { keyword[,...] | ALL }
452 Report network statistics.
453 Possible keywords are DEV, EDEV, FC, ICMP, EICMP, ICMP6, EICMP6,
455 IP, EIP, IP6, EIP6, NFS, NFSD, SOCK, SOCK6, SOFT, TCP, ETCP, UDP
456 and UDP6.
457 With the DEV keyword, statistics from the network devices are
459 reported. Statistics for all network interfaces are displayed
460 unless a restricted list is specified using option --iface= (see
461 corresponding option entry). The following values are dis‐
462 played:
463 IFACE Name of the network interface for which statistics are
465 reported.
466 rxpck/s
468 Total number of packets received per second.
469 txpck/s
471 Total number of packets transmitted per second.
472 rxkB/s Total number of kilobytes received per second.
474 txkB/s Total number of kilobytes transmitted per second.
476 rxcmp/s
478 Number of compressed packets received per second (for
479 cslip etc.).
480 txcmp/s
482 Number of compressed packets transmitted per second.
483 rxmcst/s
485 Number of multicast packets received per second.
486 %ifutil
488 Utilization percentage of the network interface. For
489 half-duplex interfaces, utilization is calculated using
490 the sum of rxkB/s and txkB/s as a percentage of the in‐
491 terface speed. For full-duplex, this is the greater of
492 rxkB/S or txkB/s.
493 With the EDEV keyword, statistics on failures (errors) from the
496 network devices are reported. Statistics for all network inter‐
497 faces are displayed unless a restricted list is specified using
498 option --iface= (see corresponding option entry). The following
499 values are displayed:
500 IFACE Name of the network interface for which statistics are
502 reported.
503 rxerr/s
505 Total number of bad packets received per second.
506 txerr/s
508 Total number of errors that happened per second while
509 transmitting packets.
510 coll/s Number of collisions that happened per second while
512 transmitting packets.
513 rxdrop/s
515 Number of received packets dropped per second because of
516 a lack of space in linux buffers.
517 txdrop/s
519 Number of transmitted packets dropped per second because
520 of a lack of space in linux buffers.
521 txcarr/s
523 Number of carrier-errors that happened per second while
524 transmitting packets.
525 rxfram/s
527 Number of frame alignment errors that happened per second
528 on received packets.
529 rxfifo/s
531 Number of FIFO overrun errors that happened per second on
532 received packets.
533 txfifo/s
535 Number of FIFO overrun errors that happened per second on
536 transmitted packets.
537 With the FC keyword, statistics about fibre channel traffic are
540 reported. Note that fibre channel statistics depend on sadc's
541 option -S DISK to be collected. The following values are dis‐
542 played:
543 FCHOST Name of the fibre channel host bus adapter (HBA) inter‐
545 face for which statistics are reported.
546 fch_rxf/s
548 The total number of frames received per second.
549 fch_txf/s
551 The total number of frames transmitted per second.
552 fch_rxw/s
554 The total number of transmission words received per sec‐
555 ond.
556 fch_txw/s
558 The total number of transmission words transmitted per
559 second.
560 With the ICMP keyword, statistics about ICMPv4 network traffic
563 are reported. Note that ICMPv4 statistics depend on sadc's op‐
564 tion -S SNMP to be collected. The following values are dis‐
565 played (formal SNMP names between square brackets):
566 imsg/s The total number of ICMP messages which the entity re‐
568 ceived per second [icmpInMsgs]. Note that this counter
569 includes all those counted by ierr/s.
570 omsg/s The total number of ICMP messages which this entity at‐
572 tempted to send per second [icmpOutMsgs]. Note that this
573 counter includes all those counted by oerr/s.
574 iech/s The number of ICMP Echo (request) messages received per
576 second [icmpInEchos].
577 iechr/s
579 The number of ICMP Echo Reply messages received per sec‐
580 ond [icmpInEchoReps].
581 oech/s The number of ICMP Echo (request) messages sent per sec‐
583 ond [icmpOutEchos].
584 oechr/s
586 The number of ICMP Echo Reply messages sent per second
587 [icmpOutEchoReps].
588 itm/s The number of ICMP Timestamp (request) messages received
590 per second [icmpInTimestamps].
591 itmr/s The number of ICMP Timestamp Reply messages received per
593 second [icmpInTimestampReps].
594 otm/s The number of ICMP Timestamp (request) messages sent per
596 second [icmpOutTimestamps].
597 otmr/s The number of ICMP Timestamp Reply messages sent per sec‐
599 ond [icmpOutTimestampReps].
600 iadrmk/s
602 The number of ICMP Address Mask Request messages received
603 per second [icmpInAddrMasks].
604 iadrmkr/s
606 The number of ICMP Address Mask Reply messages received
607 per second [icmpInAddrMaskReps].
608 oadrmk/s
610 The number of ICMP Address Mask Request messages sent per
611 second [icmpOutAddrMasks].
612 oadrmkr/s
614 The number of ICMP Address Mask Reply messages sent per
615 second [icmpOutAddrMaskReps].
616 With the EICMP keyword, statistics about ICMPv4 error messages
619 are reported. Note that ICMPv4 statistics depend on sadc's op‐
620 tion -S SNMP to be collected. The following values are dis‐
621 played (formal SNMP names between square brackets):
622 ierr/s The number of ICMP messages per second which the entity
624 received but determined as having ICMP-specific errors
625 (bad ICMP checksums, bad length, etc.) [icmpInErrors].
626 oerr/s The number of ICMP messages per second which this entity
628 did not send due to problems discovered within ICMP such
629 as a lack of buffers [icmpOutErrors].
630 idstunr/s
632 The number of ICMP Destination Unreachable messages re‐
633 ceived per second [icmpInDestUnreachs].
634 odstunr/s
636 The number of ICMP Destination Unreachable messages sent
637 per second [icmpOutDestUnreachs].
638 itmex/s
640 The number of ICMP Time Exceeded messages received per
641 second [icmpInTimeExcds].
642 otmex/s
644 The number of ICMP Time Exceeded messages sent per second
645 [icmpOutTimeExcds].
646 iparmpb/s
648 The number of ICMP Parameter Problem messages received
649 per second [icmpInParmProbs].
650 oparmpb/s
652 The number of ICMP Parameter Problem messages sent per
653 second [icmpOutParmProbs].
654 isrcq/s
656 The number of ICMP Source Quench messages received per
657 second [icmpInSrcQuenchs].
658 osrcq/s
660 The number of ICMP Source Quench messages sent per second
661 [icmpOutSrcQuenchs].
662 iredir/s
664 The number of ICMP Redirect messages received per second
665 [icmpInRedirects].
666 oredir/s
668 The number of ICMP Redirect messages sent per second
669 [icmpOutRedirects].
670 With the ICMP6 keyword, statistics about ICMPv6 network traffic
673 are reported. Note that ICMPv6 statistics depend on sadc's op‐
674 tion -S IPV6 to be collected. The following values are dis‐
675 played (formal SNMP names between square brackets):
676 imsg6/s
678 The total number of ICMP messages received by the inter‐
679 face per second which includes all those counted by
680 ierr6/s [ipv6IfIcmpInMsgs].
681 omsg6/s
683 The total number of ICMP messages which this interface
684 attempted to send per second [ipv6IfIcmpOutMsgs].
685 iech6/s
687 The number of ICMP Echo (request) messages received by
688 the interface per second [ipv6IfIcmpInEchos].
689 iechr6/s
691 The number of ICMP Echo Reply messages received by the
692 interface per second [ipv6IfIcmpInEchoReplies].
693 oechr6/s
695 The number of ICMP Echo Reply messages sent by the inter‐
696 face per second [ipv6IfIcmpOutEchoReplies].
697 igmbq6/s
699 The number of ICMPv6 Group Membership Query messages re‐
700 ceived by the interface per second [ipv6IfIcmpInGroupMem‐
701 bQueries].
702 igmbr6/s
704 The number of ICMPv6 Group Membership Response messages
705 received by the interface per second [ipv6IfIcmpInGroup‐
706 MembResponses].
707 ogmbr6/s
709 The number of ICMPv6 Group Membership Response messages
710 sent per second [ipv6IfIcmpOutGroupMembResponses].
711 igmbrd6/s
713 The number of ICMPv6 Group Membership Reduction messages
714 received by the interface per second [ipv6IfIcmpInGroup‐
715 MembReductions].
716 ogmbrd6/s
718 The number of ICMPv6 Group Membership Reduction messages
719 sent per second [ipv6IfIcmpOutGroupMembReductions].
720 irtsol6/s
722 The number of ICMP Router Solicit messages received by
723 the interface per second [ipv6IfIcmpInRouterSolicits].
724 ortsol6/s
726 The number of ICMP Router Solicitation messages sent by
727 the interface per second [ipv6IfIcmpOutRouterSolicits].
728 irtad6/s
730 The number of ICMP Router Advertisement messages received
731 by the interface per second [ipv6IfIcmpInRouterAdvertise‐
732 ments].
733 inbsol6/s
735 The number of ICMP Neighbor Solicit messages received by
736 the interface per second [ipv6IfIcmpInNeighborSolicits].
737 onbsol6/s
739 The number of ICMP Neighbor Solicitation messages sent by
740 the interface per second [ipv6IfIcmpOutNeighborSolicits].
741 inbad6/s
743 The number of ICMP Neighbor Advertisement messages re‐
744 ceived by the interface per second [ipv6IfIcmpInNeighbo‐
745 rAdvertisements].
746 onbad6/s
748 The number of ICMP Neighbor Advertisement messages sent
749 by the interface per second [ipv6IfIcmpOutNeighborAdver‐
750 tisements].
751 With the EICMP6 keyword, statistics about ICMPv6 error messages
754 are reported. Note that ICMPv6 statistics depend on sadc's op‐
755 tion -S IPV6 to be collected. The following values are dis‐
756 played (formal SNMP names between square brackets):
757 ierr6/s
759 The number of ICMP messages per second which the inter‐
760 face received but determined as having ICMP-specific er‐
761 rors (bad ICMP checksums, bad length, etc.)
762 [ipv6IfIcmpInErrors]
763 idtunr6/s
765 The number of ICMP Destination Unreachable messages re‐
766 ceived by the interface per second [ipv6IfIcmpInDestUn‐
767 reachs].
768 odtunr6/s
770 The number of ICMP Destination Unreachable messages sent
771 by the interface per second [ipv6IfIcmpOutDestUnreachs].
772 itmex6/s
774 The number of ICMP Time Exceeded messages received by the
775 interface per second [ipv6IfIcmpInTimeExcds].
776 otmex6/s
778 The number of ICMP Time Exceeded messages sent by the in‐
779 terface per second [ipv6IfIcmpOutTimeExcds].
780 iprmpb6/s
782 The number of ICMP Parameter Problem messages received by
783 the interface per second [ipv6IfIcmpInParmProblems].
784 oprmpb6/s
786 The number of ICMP Parameter Problem messages sent by the
787 interface per second [ipv6IfIcmpOutParmProblems].
788 iredir6/s
790 The number of Redirect messages received by the interface
791 per second [ipv6IfIcmpInRedirects].
792 oredir6/s
794 The number of Redirect messages sent by the interface by
795 second [ipv6IfIcmpOutRedirects].
796 ipck2b6/s
798 The number of ICMP Packet Too Big messages received by
799 the interface per second [ipv6IfIcmpInPktTooBigs].
800 opck2b6/s
802 The number of ICMP Packet Too Big messages sent by the
803 interface per second [ipv6IfIcmpOutPktTooBigs].
804 With the IP keyword, statistics about IPv4 network traffic are
807 reported. Note that IPv4 statistics depend on sadc's option -S
808 SNMP to be collected. The following values are displayed (for‐
809 mal SNMP names between square brackets):
810 irec/s The total number of input datagrams received from inter‐
812 faces per second, including those received in error [ip‐
813 InReceives].
814 fwddgm/s
816 The number of input datagrams per second, for which this
817 entity was not their final IP destination, as a result of
818 which an attempt was made to find a route to forward them
819 to that final destination [ipForwDatagrams].
820 idel/s The total number of input datagrams successfully deliv‐
822 ered per second to IP user-protocols (including ICMP)
823 [ipInDelivers].
824 orq/s The total number of IP datagrams which local IP user-pro‐
826 tocols (including ICMP) supplied per second to IP in re‐
827 quests for transmission [ipOutRequests]. Note that this
828 counter does not include any datagrams counted in fwd‐
829 dgm/s.
830 asmrq/s
832 The number of IP fragments received per second which
833 needed to be reassembled at this entity [ipReasmReqds].
834 asmok/s
836 The number of IP datagrams successfully re-assembled per
837 second [ipReasmOKs].
838 fragok/s
840 The number of IP datagrams that have been successfully
841 fragmented at this entity per second [ipFragOKs].
842 fragcrt/s
844 The number of IP datagram fragments that have been gener‐
845 ated per second as a result of fragmentation at this en‐
846 tity [ipFragCreates].
847 With the EIP keyword, statistics about IPv4 network errors are
850 reported. Note that IPv4 statistics depend on sadc's option -S
851 SNMP to be collected. The following values are displayed (for‐
852 mal SNMP names between square brackets):
853 ihdrerr/s
855 The number of input datagrams discarded per second due to
856 errors in their IP headers, including bad checksums, ver‐
857 sion number mismatch, other format errors, time-to-live
858 exceeded, errors discovered in processing their IP op‐
859 tions, etc. [ipInHdrErrors]
860 iadrerr/s
862 The number of input datagrams discarded per second be‐
863 cause the IP address in their IP header's destination
864 field was not a valid address to be received at this en‐
865 tity. This count includes invalid addresses (e.g.,
866 0.0.0.0) and addresses of unsupported Classes (e.g.,
867 Class E). For entities which are not IP routers and
868 therefore do not forward datagrams, this counter includes
869 datagrams discarded because the destination address was
870 not a local address [ipInAddrErrors].
871 iukwnpr/s
873 The number of locally-addressed datagrams received suc‐
874 cessfully but discarded per second because of an unknown
875 or unsupported protocol [ipInUnknownProtos].
876 idisc/s
878 The number of input IP datagrams per second for which no
879 problems were encountered to prevent their continued pro‐
880 cessing, but which were discarded (e.g., for lack of buf‐
881 fer space) [ipInDiscards]. Note that this counter does
882 not include any datagrams discarded while awaiting re-as‐
883 sembly.
884 odisc/s
886 The number of output IP datagrams per second for which no
887 problem was encountered to prevent their transmission to
888 their destination, but which were discarded (e.g., for
889 lack of buffer space) [ipOutDiscards]. Note that this
890 counter would include datagrams counted in fwddgm/s if
891 any such packets met this (discretionary) discard crite‐
892 rion.
893 onort/s
895 The number of IP datagrams discarded per second because
896 no route could be found to transmit them to their desti‐
897 nation [ipOutNoRoutes]. Note that this counter includes
898 any packets counted in fwddgm/s which meet this 'no-
899 route' criterion. Note that this includes any datagrams
900 which a host cannot route because all of its default
901 routers are down.
902 asmf/s The number of failures detected per second by the IP re-
904 assembly algorithm (for whatever reason: timed out, er‐
905 rors, etc) [ipReasmFails]. Note that this is not neces‐
906 sarily a count of discarded IP fragments since some algo‐
907 rithms can lose track of the number of fragments by com‐
908 bining them as they are received.
909 fragf/s
911 The number of IP datagrams that have been discarded per
912 second because they needed to be fragmented at this en‐
913 tity but could not be, e.g., because their Don't Fragment
914 flag was set [ipFragFails].
915 With the IP6 keyword, statistics about IPv6 network traffic are
918 reported. Note that IPv6 statistics depend on sadc's option -S
919 IPV6 to be collected. The following values are displayed (for‐
920 mal SNMP names between square brackets):
921 irec6/s
923 The total number of input datagrams received from inter‐
924 faces per second, including those received in error
925 [ipv6IfStatsInReceives].
926 fwddgm6/s
928 The number of output datagrams per second which this en‐
929 tity received and forwarded to their final destinations
930 [ipv6IfStatsOutForwDatagrams].
931 idel6/s
933 The total number of datagrams successfully delivered per
934 second to IPv6 user-protocols (including ICMP) [ipv6IfS‐
935 tatsInDelivers].
936 orq6/s The total number of IPv6 datagrams which local IPv6 user-
938 protocols (including ICMP) supplied per second to IPv6 in
939 requests for transmission [ipv6IfStatsOutRequests]. Note
940 that this counter does not include any datagrams counted
941 in fwddgm6/s.
942 asmrq6/s
944 The number of IPv6 fragments received per second which
945 needed to be reassembled at this interface [ipv6IfStat‐
946 sReasmReqds].
947 asmok6/s
949 The number of IPv6 datagrams successfully reassembled per
950 second [ipv6IfStatsReasmOKs].
951 imcpck6/s
953 The number of multicast packets received per second by
954 the interface [ipv6IfStatsInMcastPkts].
955 omcpck6/s
957 The number of multicast packets transmitted per second by
958 the interface [ipv6IfStatsOutMcastPkts].
959 fragok6/s
961 The number of IPv6 datagrams that have been successfully
962 fragmented at this output interface per second [ipv6IfS‐
963 tatsOutFragOKs].
964 fragcr6/s
966 The number of output datagram fragments that have been
967 generated per second as a result of fragmentation at this
968 output interface [ipv6IfStatsOutFragCreates].
969 With the EIP6 keyword, statistics about IPv6 network errors are
972 reported. Note that IPv6 statistics depend on sadc's option -S
973 IPV6 to be collected. The following values are displayed (for‐
974 mal SNMP names between square brackets):
975 ihdrer6/s
977 The number of input datagrams discarded per second due to
978 errors in their IPv6 headers, including version number
979 mismatch, other format errors, hop count exceeded, errors
980 discovered in processing their IPv6 options, etc.
981 [ipv6IfStatsInHdrErrors]
982 iadrer6/s
984 The number of input datagrams discarded per second be‐
985 cause the IPv6 address in their IPv6 header's destination
986 field was not a valid address to be received at this en‐
987 tity. This count includes invalid addresses (e.g., ::0)
988 and unsupported addresses (e.g., addresses with unallo‐
989 cated prefixes). For entities which are not IPv6 routers
990 and therefore do not forward datagrams, this counter in‐
991 cludes datagrams discarded because the destination ad‐
992 dress was not a local address [ipv6IfStatsInAddrErrors].
993 iukwnp6/s
995 The number of locally-addressed datagrams received suc‐
996 cessfully but discarded per second because of an unknown
997 or unsupported protocol [ipv6IfStatsInUnknownProtos].
998 i2big6/s
1000 The number of input datagrams that could not be forwarded
1001 per second because their size exceeded the link MTU of
1002 outgoing interface [ipv6IfStatsInTooBigErrors].
1003 idisc6/s
1005 The number of input IPv6 datagrams per second for which
1006 no problems were encountered to prevent their continued
1007 processing, but which were discarded (e.g., for lack of
1008 buffer space) [ipv6IfStatsInDiscards]. Note that this
1009 counter does not include any datagrams discarded while
1010 awaiting re-assembly.
1011 odisc6/s
1013 The number of output IPv6 datagrams per second for which
1014 no problem was encountered to prevent their transmission
1015 to their destination, but which were discarded (e.g., for
1016 lack of buffer space) [ipv6IfStatsOutDiscards]. Note that
1017 this counter would include datagrams counted in fwddgm6/s
1018 if any such packets met this (discretionary) discard cri‐
1019 terion.
1020 inort6/s
1022 The number of input datagrams discarded per second be‐
1023 cause no route could be found to transmit them to their
1024 destination [ipv6IfStatsInNoRoutes].
1025 onort6/s
1027 The number of locally generated IP datagrams discarded
1028 per second because no route could be found to transmit
1029 them to their destination [unknown formal SNMP name].
1030 asmf6/s
1032 The number of failures detected per second by the IPv6
1033 re-assembly algorithm (for whatever reason: timed out,
1034 errors, etc.) [ipv6IfStatsReasmFails]. Note that this is
1035 not necessarily a count of discarded IPv6 fragments since
1036 some algorithms can lose track of the number of fragments
1037 by combining them as they are received.
1038 fragf6/s
1040 The number of IPv6 datagrams that have been discarded per
1041 second because they needed to be fragmented at this out‐
1042 put interface but could not be [ipv6IfStatsOutFragFails].
1043 itrpck6/s
1045 The number of input datagrams discarded per second be‐
1046 cause datagram frame didn't carry enough data [ipv6IfS‐
1047 tatsInTruncatedPkts].
1048 With the NFS keyword, statistics about NFS client activity are
1051 reported. The following values are displayed:
1052 call/s Number of RPC requests made per second.
1054 retrans/s
1056 Number of RPC requests per second, those which needed to
1057 be retransmitted (for example because of a server time‐
1058 out).
1059 read/s Number of 'read' RPC calls made per second.
1061 write/s
1063 Number of 'write' RPC calls made per second.
1064 access/s
1066 Number of 'access' RPC calls made per second.
1067 getatt/s
1069 Number of 'getattr' RPC calls made per second.
1070 With the NFSD keyword, statistics about NFS server activity are
1073 reported. The following values are displayed:
1074 scall/s
1076 Number of RPC requests received per second.
1077 badcall/s
1079 Number of bad RPC requests received per second, those
1080 whose processing generated an error.
1081 packet/s
1083 Number of network packets received per second.
1084 udp/s Number of UDP packets received per second.
1086 tcp/s Number of TCP packets received per second.
1088 hit/s Number of reply cache hits per second.
1090 miss/s Number of reply cache misses per second.
1092 sread/s
1094 Number of 'read' RPC calls received per second.
1095 swrite/s
1097 Number of 'write' RPC calls received per second.
1098 saccess/s
1100 Number of 'access' RPC calls received per second.
1101 sgetatt/s
1103 Number of 'getattr' RPC calls received per second.
1104 With the SOCK keyword, statistics on sockets in use are reported
1107 (IPv4). The following values are displayed:
1108 totsck Total number of sockets used by the system.
1110 tcpsck Number of TCP sockets currently in use.
1112 udpsck Number of UDP sockets currently in use.
1114 rawsck Number of RAW sockets currently in use.
1116 ip-frag
1118 Number of IP fragments currently in queue.
1119 tcp-tw Number of TCP sockets in TIME_WAIT state.
1121 With the SOCK6 keyword, statistics on sockets in use are re‐
1124 ported (IPv6). Note that IPv6 statistics depend on sadc's op‐
1125 tion -S IPV6 to be collected. The following values are dis‐
1126 played:
1127 tcp6sck
1129 Number of TCPv6 sockets currently in use.
1130 udp6sck
1132 Number of UDPv6 sockets currently in use.
1133 raw6sck
1135 Number of RAWv6 sockets currently in use.
1136 ip6-frag
1138 Number of IPv6 fragments currently in use.
1139 With the SOFT keyword, statistics about software-based network
1142 processing are reported. The following values are displayed:
1143 total/s
1145 The total number of network frames processed per second.
1146 dropd/s
1148 The total number of network frames dropped per second be‐
1149 cause there was no room on the processing queue.
1150 squeezd/s
1152 The number of times the softirq handler function termi‐
1153 nated per second because its budget was consumed or the
1154 time limit was reached, but more work could have been
1155 done.
1156 rx_rps/s
1158 The number of times the CPU has been woken up per second
1159 to process packets via an inter-processor interrupt.
1160 flw_lim/s
1162 The number of times the flow limit has been reached per
1163 second. Flow limiting is an optional RPS feature that
1164 can be used to limit the number of packets queued to the
1165 backlog for each flow to a certain amount. This can help
1166 ensure that smaller flows are processed even though much
1167 larger flows are pushing packets in.
1168 blg_len
1170 The length of the network backlog.
1171 With the TCP keyword, statistics about TCPv4 network traffic are
1174 reported. Note that TCPv4 statistics depend on sadc's option -S
1175 SNMP to be collected. The following values are displayed (for‐
1176 mal SNMP names between square brackets):
1177 active/s
1179 The number of times TCP connections have made a direct
1180 transition to the SYN-SENT state from the CLOSED state
1181 per second [tcpActiveOpens].
1182 passive/s
1184 The number of times TCP connections have made a direct
1185 transition to the SYN-RCVD state from the LISTEN state
1186 per second [tcpPassiveOpens].
1187 iseg/s The total number of segments received per second, includ‐
1189 ing those received in error [tcpInSegs]. This count in‐
1190 cludes segments received on currently established connec‐
1191 tions.
1192 oseg/s The total number of segments sent per second, including
1194 those on current connections but excluding those contain‐
1195 ing only retransmitted octets [tcpOutSegs].
1196 With the ETCP keyword, statistics about TCPv4 network errors are
1199 reported. Note that TCPv4 statistics depend on sadc's option -S
1200 SNMP to be collected. The following values are displayed (for‐
1201 mal SNMP names between square brackets):
1202 atmptf/s
1204 The number of times per second TCP connections have made
1205 a direct transition to the CLOSED state from either the
1206 SYN-SENT state or the SYN-RCVD state, plus the number of
1207 times per second TCP connections have made a direct tran‐
1208 sition to the LISTEN state from the SYN-RCVD state [tc‐
1209 pAttemptFails].
1210 estres/s
1212 The number of times per second TCP connections have made
1213 a direct transition to the CLOSED state from either the
1214 ESTABLISHED state or the CLOSE-WAIT state [tcpEstabRe‐
1215 sets].
1216 retrans/s
1218 The total number of segments retransmitted per second -
1219 that is, the number of TCP segments transmitted contain‐
1220 ing one or more previously transmitted octets [tcpRe‐
1221 transSegs].
1222 isegerr/s
1224 The total number of segments received in error (e.g., bad
1225 TCP checksums) per second [tcpInErrs].
1226 orsts/s
1228 The number of TCP segments sent per second containing the
1229 RST flag [tcpOutRsts].
1230 With the UDP keyword, statistics about UDPv4 network traffic are
1233 reported. Note that UDPv4 statistics depend on sadc's option -S
1234 SNMP to be collected. The following values are displayed (for‐
1235 mal SNMP names between square brackets):
1236 idgm/s The total number of UDP datagrams delivered per second to
1238 UDP users [udpInDatagrams].
1239 odgm/s The total number of UDP datagrams sent per second from
1241 this entity [udpOutDatagrams].
1242 noport/s
1244 The total number of received UDP datagrams per second for
1245 which there was no application at the destination port
1246 [udpNoPorts].
1247 idgmerr/s
1249 The number of received UDP datagrams per second that
1250 could not be delivered for reasons other than the lack of
1251 an application at the destination port [udpInErrors].
1252 With the UDP6 keyword, statistics about UDPv6 network traffic
1255 are reported. Note that UDPv6 statistics depend on sadc's op‐
1256 tion -S IPV6 to be collected. The following values are dis‐
1257 played (formal SNMP names between square brackets):
1258 idgm6/s
1260 The total number of UDP datagrams delivered per second to
1261 UDP users [udpInDatagrams].
1262 odgm6/s
1264 The total number of UDP datagrams sent per second from
1265 this entity [udpOutDatagrams].
1266 noport6/s
1268 The total number of received UDP datagrams per second for
1269 which there was no application at the destination port
1270 [udpNoPorts].
1271 idgmer6/s
1273 The number of received UDP datagrams per second that
1274 could not be delivered for reasons other than the lack of
1275 an application at the destination port [udpInErrors].
1276 The ALL keyword is equivalent to specifying all the keywords
1279 above and therefore all the network activities are reported.
1280 -o [ filename ]
1282 Save the readings in the file in binary form. Each reading is in
1283 a separate record. The default value of the filename parameter
1284 is the current standard system activity daily data file. If
1285 filename is a directory instead of a plain file then it is con‐
1286 sidered as the directory where the standard system activity
1287 daily data files are located. Option -o is exclusive of option
1288 -f. All the data available from the kernel are saved in the
1289 file (in fact, sar calls its data collector sadc with the option
1290 -S ALL. See sadc(8) manual page).
1291 -P { cpu_list | ALL }
1293 Report per-processor statistics for the specified processor or
1294 processors. cpu_list is a list of comma-separated values or
1295 range of values (e.g., 0,2,4-7,12-). Note that processor 0 is
1296 the first processor, and processor all is the global average
1297 among all processors. Specifying the ALL keyword reports sta‐
1298 tistics for each individual processor, and globally for all pro‐
1299 cessors. Offline processors are not displayed.
1300 -p, --pretty
1302 Make reports easier to read by a human. This option may be es‐
1303 pecially useful when displaying e.g., network interfaces or
1304 block devices statistics.
1305 -q [ keyword[,...] | ALL ]
1307 Report system load and pressure-stall statistics.
1308 Possible keywords are CPU, IO, LOAD, MEM and PSI.
1310 With the CPU keyword, CPU pressure statistics are reported. The
1312 following values are displayed:
1313 %scpu-10
1315 Percentage of the time that at least some runnable tasks
1316 were delayed because the CPU was unavailable to them,
1317 over the last 10 second window.
1318 %scpu-60
1320 Percentage of the time that at least some runnable tasks
1321 were delayed because the CPU was unavailable to them,
1322 over the last 60 second window.
1323 %scpu-300
1325 Percentage of the time that at least some runnable tasks
1326 were delayed because the CPU was unavailable to them,
1327 over the last 300 second window.
1328 %scpu Percentage of the time that at least some runnable tasks
1330 were delayed because the CPU was unavailable to them,
1331 over the last time interval.
1332 With the IO keyword, I/O pressure statistics are reported. The
1335 following values are displayed:
1336 %sio-10
1338 Percentage of the time that at least some tasks lost
1339 waiting for I/O, over the last 10 second window.
1340 %sio-60
1342 Percentage of the time that at least some tasks lost
1343 waiting for I/O, over the last 60 second window.
1344 %sio-300
1346 Percentage of the time that at least some tasks lost
1347 waiting for I/O, over the last 300 second window.
1348 %sio Percentage of the time that at least some tasks lost
1350 waiting for I/O, over the last time interval.
1351 %fio-10
1353 Percentage of the time during which all non-idle tasks
1354 were stalled waiting for I/O, over the last 10 second
1355 window.
1356 %fio-60
1358 Percentage of the time during which all non-idle tasks
1359 were stalled waiting for I/O, over the last 60 second
1360 window.
1361 %fio-300
1363 Percentage of the time during which all non-idle tasks
1364 were stalled waiting for I/O, over the last 300 second
1365 window.
1366 %fio Percentage of the time during which all non-idle tasks
1368 were stalled waiting for I/O, over the last time inter‐
1369 val.
1370 With the LOAD keyword, queue length and load averages statistics
1373 are reported. The following values are displayed:
1374 runq-sz
1376 Run queue length (number of tasks running or waiting for
1377 run time).
1378 plist-sz
1380 Number of tasks in the task list.
1381 ldavg-1
1383 System load average for the last minute. The load aver‐
1384 age is calculated as the average number of runnable or
1385 running tasks (R state), and the number of tasks in unin‐
1386 terruptible sleep (D state) over the specified interval.
1387 ldavg-5
1389 System load average for the past 5 minutes.
1390 ldavg-15
1392 System load average for the past 15 minutes.
1393 blocked
1395 Number of tasks currently blocked, waiting for I/O to
1396 complete.
1397 With the MEM keyword, memory pressure statistics are reported.
1400 The following values are displayed:
1401 %smem-10
1403 Percentage of the time during which at least some tasks
1404 were waiting for memory resources, over the last 10 sec‐
1405 ond window.
1406 %smem-60
1408 Percentage of the time during which at least some tasks
1409 were waiting for memory resources, over the last 60 sec‐
1410 ond window.
1411 %smem-300
1413 Percentage of the time during which at least some tasks
1414 were waiting for memory resources, over the last 300 sec‐
1415 ond window.
1416 %smem Percentage of the time during which at least some tasks
1418 were waiting for memory resources, over the last time in‐
1419 terval.
1420 %fmem-10
1422 Percentage of the time during which all non-idle tasks
1423 were stalled waiting for memory resources, over the last
1424 10 second window.
1425 %fmem-60
1427 Percentage of the time during which all non-idle tasks
1428 were stalled waiting for memory resources, over the last
1429 60 second window.
1430 %fmem-300
1432 Percentage of the time during which all non-idle tasks
1433 were stalled waiting for memory resources, over the last
1434 300 second window.
1435 %fmem Percentage of the time during which all non-idle tasks
1437 were stalled waiting for memory resources, over the last
1438 time interval.
1439 The PSI keyword is equivalent to specifying CPU, IO and MEM key‐
1442 words together and therefore all the pressure-stall statistics
1443 are reported.
1444 The ALL keyword is equivalent to specifying all the keywords
1446 above and therefore all the statistics are reported.
1447 -r [ ALL ]
1449 Report memory utilization statistics. The ALL keyword indicates
1450 that all the memory fields should be displayed. The following
1451 values may be displayed:
1452 kbmemfree
1454 Amount of free memory available in kilobytes.
1455 kbavail
1457 Estimate of how much memory in kilobytes is available for
1458 starting new applications, without swapping. The esti‐
1459 mate takes into account that the system needs some page
1460 cache to function well, and that not all reclaimable slab
1461 will be reclaimable, due to items being in use. The im‐
1462 pact of those factors will vary from system to system.
1463 kbmemused
1465 Amount of used memory in kilobytes (calculated as total
1466 installed memory - kbmemfree - kbbuffers - kbcached - kb‐
1467 slab).
1468 %memused
1470 Percentage of used memory.
1471 kbbuffers
1473 Amount of memory used as buffers by the kernel in kilo‐
1474 bytes.
1475 kbcached
1477 Amount of memory used to cache data by the kernel in
1478 kilobytes.
1479 kbcommit
1481 Amount of memory in kilobytes needed for current work‐
1482 load. This is an estimate of how much RAM/swap is needed
1483 to guarantee that there never is out of memory.
1484 %commit
1486 Percentage of memory needed for current workload in rela‐
1487 tion to the total amount of memory (RAM+swap). This num‐
1488 ber may be greater than 100% because the kernel usually
1489 overcommits memory.
1490 kbactive
1492 Amount of active memory in kilobytes (memory that has
1493 been used more recently and usually not reclaimed unless
1494 absolutely necessary).
1495 kbinact
1497 Amount of inactive memory in kilobytes (memory which has
1498 been less recently used. It is more eligible to be re‐
1499 claimed for other purposes).
1500 kbdirty
1502 Amount of memory in kilobytes waiting to get written back
1503 to the disk.
1504 kbanonpg
1506 Amount of non-file backed pages in kilobytes mapped into
1507 userspace page tables.
1508 kbslab Amount of memory in kilobytes used by the kernel to cache
1510 data structures for its own use.
1511 kbkstack
1513 Amount of memory in kilobytes used for kernel stack
1514 space.
1515 kbpgtbl
1517 Amount of memory in kilobytes dedicated to the lowest
1518 level of page tables.
1519 kbvmused
1521 Amount of memory in kilobytes of used virtual address
1522 space.
1523 -S Report swap space utilization statistics. The following values
1525 are displayed:
1526 kbswpfree
1528 Amount of free swap space in kilobytes.
1529 kbswpused
1531 Amount of used swap space in kilobytes.
1532 %swpused
1534 Percentage of used swap space.
1535 kbswpcad
1537 Amount of cached swap memory in kilobytes. This is mem‐
1538 ory that once was swapped out, is swapped back in but
1539 still also is in the swap area (if memory is needed it
1540 doesn't need to be swapped out again because it is al‐
1541 ready in the swap area. This saves I/O).
1542 %swpcad
1544 Percentage of cached swap memory in relation to the
1545 amount of used swap space.
1546 -s [ hh:mm[:ss] ]
1548 -s [ seconds_since_the_epoch ]
1549 Set the starting time of the data, causing the sar command to
1550 extract records time-tagged at, or following, the time speci‐
1551 fied. The default starting time is 08:00:00. Hours must be
1552 given in 24-hour format, or as the number of seconds since the
1553 epoch (given as a 10 digit number). This option can be used only
1554 when data are read from a file (option -f).
1555 --sadc Indicate which data collector is called by sar. If the data
1557 collector is sought in PATH then enter "which sadc" to know
1558 where it is located.
1559 -t When reading data from a daily data file, indicate that sar
1561 should display the timestamps in the original local time of the
1562 data file creator. Without this option, the sar command displays
1563 the timestamps in the user's local time.
1564 -u [ ALL ]
1566 Report CPU utilization. The ALL keyword indicates that all the
1567 CPU fields should be displayed. The report may show the follow‐
1568 ing fields:
1569 %user Percentage of CPU utilization that occurred while execut‐
1571 ing at the user level (application). Note that this field
1572 includes time spent running virtual processors.
1573 %usr Percentage of CPU utilization that occurred while execut‐
1575 ing at the user level (application). Note that this field
1576 does NOT include time spent running virtual processors.
1577 %nice Percentage of CPU utilization that occurred while execut‐
1579 ing at the user level with nice priority.
1580 %system
1582 Percentage of CPU utilization that occurred while execut‐
1583 ing at the system level (kernel). Note that this field
1584 includes time spent servicing hardware and software in‐
1585 terrupts.
1586 %sys Percentage of CPU utilization that occurred while execut‐
1588 ing at the system level (kernel). Note that this field
1589 does NOT include time spent servicing hardware or soft‐
1590 ware interrupts.
1591 %iowait
1593 Percentage of time that the CPU or CPUs were idle during
1594 which the system had an outstanding disk I/O request.
1595 %steal Percentage of time spent in involuntary wait by the vir‐
1597 tual CPU or CPUs while the hypervisor was servicing an‐
1598 other virtual processor.
1599 %irq Percentage of time spent by the CPU or CPUs to service
1601 hardware interrupts.
1602 %soft Percentage of time spent by the CPU or CPUs to service
1604 software interrupts.
1605 %guest Percentage of time spent by the CPU or CPUs to run a vir‐
1607 tual processor.
1608 %gnice Percentage of time spent by the CPU or CPUs to run a
1610 niced guest.
1611 %idle Percentage of time that the CPU or CPUs were idle and the
1613 system did not have an outstanding disk I/O request.
1614 -V Print version number then exit.
1616 -v Report status of inode, file and other kernel tables. The fol‐
1618 lowing values are displayed:
1619 dentunusd
1621 Number of unused cache entries in the directory cache.
1622 file-nr
1624 Number of file handles used by the system.
1625 inode-nr
1627 Number of inode handlers used by the system.
1628 pty-nr Number of pseudo-terminals used by the system.
1630 -W Report swapping statistics. The following values are displayed:
1632 pswpin/s
1634 Total number of swap pages the system brought in per sec‐
1635 ond.
1636 pswpout/s
1638 Total number of swap pages the system brought out per
1639 second.
1640 -w Report task creation and system switching activity. The follow‐
1642 ing values are displayed:
1643 proc/s Total number of tasks created per second.
1645 cswch/s
1647 Total number of context switches per second.
1648 -x Extended reports: Display minimum and maximum values in addition
1650 to average ones at the end of the report.
1651 -y Report TTY devices activity. The following values are displayed:
1653 rcvin/s
1655 Number of receive interrupts per second for current se‐
1656 rial line. Serial line number is given in the TTY col‐
1657 umn.
1658 xmtin/s
1660 Number of transmit interrupts per second for current se‐
1661 rial line.
1662 framerr/s
1664 Number of frame errors per second for current serial
1665 line.
1666 prtyerr/s
1668 Number of parity errors per second for current serial
1669 line.
1670 brk/s Number of breaks per second for current serial line.
1672 ovrun/s
1674 Number of overrun errors per second for current serial
1675 line.
1676 -z Tell sar to omit output for any devices for which there was no
1678 activity during the sample period.
1679
1682 The sar command takes into account the following environment variables:
1683 S_COLORS
1685 By default statistics are displayed in color when the output is
1686 connected to a terminal. Use this variable to change the set‐
1687 tings. Possible values for this variable are never, always or
1688 auto (the latter is equivalent to the default settings).
1689 Please note that the color (being red, yellow, or some other
1690 color) used to display a value is not indicative of any kind of
1691 issue simply because of the color. It only indicates different
1692 ranges of values.
1693 S_COLORS_SGR
1695 Specify the colors and other attributes used to display statis‐
1696 tics on the terminal. Its value is a colon-separated list of
1697 capabilities that defaults to
1698 C=33;22:I=32;22:N=34;1:R=31;22:W=35;1:X=31;1:Z=34;22. Supported
1699 capabilities are:
1700 C= SGR (Select Graphic Rendition) substring for comments in‐
1702 serted in the binary daily data files.
1703 I= SGR substring for item names or values (eg. network in‐
1705 terfaces, CPU number...)
1706 N= SGR substring for non-zero statistics values.
1708 R= SGR substring for restart messages.
1710 W= (or M=)
1712 SGR substring for percentage values in the range from 75%
1713 to 90% (or in the range 10% to 25% depending on the met‐
1714 ric's meaning). It is also used for negative values in
1715 the range from -10 to -5.
1716 X= (or H=)
1718 SGR substring for percentage values greater than or equal
1719 to 90% (or lower than or equal to 10% depending on the
1720 metric's meaning). It is also used for negative values
1721 lower than or equal to -10.
1722 Z= SGR substring for zero values.
1724 S_REPEAT_HEADER
1726 This variable contains the maximum number of lines after which a
1727 header has to be displayed by sar when the output is not a ter‐
1728 minal.
1729 S_TIME_DEF_TIME
1731 If this variable exists and its value is UTC then sar will save
1732 its data in UTC time (data will still be displayed in local
1733 time). sar will also use UTC time instead of local time to de‐
1734 termine the current daily data file located in the /var/log/sa
1735 directory. This variable may be useful for servers with users
1736 located across several timezones.
1737 S_TIME_FORMAT
1739 If this variable exists and its value is ISO then the current
1740 locale will be ignored when printing the date in the report
1741 header. The sar command will use the ISO 8601 format (YYYY-MM-
1742 DD) instead. The timestamp will also be compliant with ISO 8601
1743 format.
1744
1747 sar -u 2 5
1748 Report CPU utilization for each 2 seconds. 5 lines are dis‐
1749 played.
1750 sar -I --int=14 -o int14.file 2 10
1752 Report statistics on IRQ 14 for each 2 seconds. 10 lines are
1753 displayed. Data are stored in a file called int14.file.
1754 sar -r -n DEV -f /var/log/sa/sa16
1756 Display memory and network statistics saved in daily data file
1757 sa16.
1758 sar -A Display all the statistics saved in current daily data file.
1760
1763 /proc filesystem must be mounted for the sar command to work.
1764 All the statistics are not necessarily available, depending on the ker‐
1766 nel version used. sar assumes that you are using at least a 2.6 ker‐
1767 nel.
1768 Although sar speaks of kilobytes (kB), megabytes (MB)..., it actually
1770 uses kibibytes (kiB), mebibytes (MiB)... A kibibyte is equal to 1024
1771 bytes, and a mebibyte is equal to 1024 kibibytes.
1772
1775 /var/log/sa/saDD
1776 /var/log/sa/saYYYYMMDD
1777 The standard system activity daily data files and their default
1778 location. YYYY stands for the current year, MM for the current
1779 month and DD for the current day.
1780 /proc and /sys contain various files with system statistics.
1782
1785 Sebastien Godard (sysstat <at> orange.fr)
1786
1789 sadc(8), sa1(8), sa2(8), sadf(1), sysstat(5), pidstat(1), mpstat(1),
1790 iostat(1), vmstat(8)
1791 https://github.com/sysstat/sysstat
1793Linux MAY 2023 SAR(1)