1SAR(1) Linux User's Manual SAR(1)
2
6 sar - Collect, report, or save system activity information.
7
9 sar [ -A ] [ -b ] [ -B ] [ -c ] [ -d ] [ -i interval ] [ -p ] [ -q ] [
10 -r ] [ -R ] [ -t ] [ -u ] [ -v ] [ -V ] [ -w ] [ -W ] [ -y ] [ -n { DEV
11 | EDEV | NFS | NFSD | SOCK | ALL } ] [ -x { pid | SELF | ALL } ] [ -X {
12 pid | SELF | ALL } ] [ -I { irq | SUM | ALL | XALL } ] [ -P { cpu | ALL
13 } ] [ -o [ filename ] | -f [ filename ] ] [ -s [ hh:mm:ss ] ] [ -e [
14 hh:mm:ss ] ] [ interval [ count ] ]
15
17 The sar command writes to standard output the contents of selected
18 cumulative activity counters in the operating system. The accounting
19 system, based on the values in the count and interval parameters,
20 writes information the specified number of times spaced at the speci‐
21 fied intervals in seconds. If the interval parameter is set to zero,
22 the sar command displays the average statistics for the time since the
23 system was started. The default value for the count parameter is 1. If
24 its value is set to zero, then reports are generated continuously. The
25 collected data can also be saved in the file specified by the -o file‐
26 name flag, in addition to being displayed onto the screen. If filename
27 is omitted, sar uses the standard system activity daily data file, the
28 /var/log/sa/sadd file, where the dd parameter indicates the current
29 day. By default all the data available from the kernel are saved in
30 the data file. Exceptions are interrupts and disks data, for which the
31 relevant options must be explicitly passed to sar (or to its backend
32 sadc ) when the data file is created (see options below).
33 The sar command extracts and writes to standard output records previ‐
35 ously saved in a file. This file can be either the one specified by the
36 -f flag or, by default, the standard system activity daily data file.
37 Without the -P flag, the sar command reports system-wide (global among
39 all processors) statistics, which are calculated as averages for values
40 expressed as percentages, and as sums otherwise. If the -P flag is
41 given, the sar command reports activity which relates to the specified
42 processor or processors. If -P ALL is given, the sar command reports
43 statistics for each individual processor and global statistics among
44 all processors.
45 You can select information about specific system activities using
47 flags. Not specifying any flags selects only CPU activity. Specifying
48 the -A flag is equivalent to specifying -bBcdqrRuvwWy -I SUM -I XALL -n
49 ALL -P ALL.
50 The default version of the sar command (CPU utilization report) might
52 be one of the first facilities the user runs to begin system activity
53 investigation, because it monitors major system resources. If CPU uti‐
54 lization is near 100 percent (user + nice + system), the workload sam‐
55 pled is CPU-bound.
56 If multiple samples and multiple reports are desired, it is convenient
58 to specify an output file for the sar command. Run the sar command as
59 a background process. The syntax for this is:
60 sar -o datafile interval count >/dev/null 2>&1 &
62 All data is captured in binary form and saved to a file (datafile).
64 The data can then be selectively displayed with the sar command using
65 the -f option. Set the interval and count parameters to select count
66 records at interval second intervals. If the count parameter is not
67 set, all the records saved in the file will be selected. Collection of
68 data in this manner is useful to characterize system usage over a
69 period of time and determine peak usage hours.
70 Note: The sar command only reports on local activities.
72
75 -A This is equivalent to specifying -bBcdqrRuvwWy -I SUM -I XALL -n
76 ALL -P ALL.
77 -b Report I/O and transfer rate statistics. The following values
79 are displayed:
80 tps
82 Total number of transfers per second that were issued to
83 physical devices. A transfer is an I/O request to a
84 physical device. Multiple logical requests can be com‐
85 bined into a single I/O request to the device. A trans‐
86 fer is of indeterminate size.
87 rtps
89 Total number of read requests per second issued to physi‐
90 cal devices.
91 wtps
93 Total number of write requests per second issued to phys‐
94 ical devices.
95 bread/s
97 Total amount of data read from the devices in blocks per
98 second. Blocks are equivalent to sectors with 2.4 ker‐
99 nels and newer and therefore have a size of 512 bytes.
100 With older kernels, a block is of indeterminate size.
101 bwrtn/s
103 Total amount of data written to devices in blocks per
104 second.
105 -B Report paging statistics. The following values are displayed:
107 pgpgin/s
109 Total number of kilobytes the system paged in from disk
110 per second. Note: With old kernels (2.2.x) this value is
111 a number of blocks per second (and not kilobytes).
112 pgpgout/s
114 Total number of kilobytes the system paged out to disk
115 per second. Note: With old kernels (2.2.x) this value is
116 a number of blocks per second (and not kilobytes).
117 fault/s
119 Number of page faults (major + minor) made by the system
120 per second (post 2.5 kernels only). This is not a count
121 of page faults that generate I/O, because some page
122 faults can be resolved without I/O.
123 majflt/s
125 Number of major faults the system has made per second,
126 those which have required loading a memory page from disk
127 (post 2.5 kernels only).
128 -c Report process creation activity.
130 proc/s
132 Total number of processes created per second.
133 -d Report activity for each block device (kernels 2.4 and newer
135 only). When data is displayed, the device specification dev m-n
136 is generally used ( DEV column). m is the major number of the
137 device. With recent kernels (post 2.5), n is the minor number
138 of the device, but is only a sequence number with pre 2.5 ker‐
139 nels. Device names may also be pretty-printed if option -p is
140 used (see below). Values for fields avgqu-sz, await, svctm and
141 %util may be unavailable and displayed as 0.00 with some 2.4
142 kernels.
143 tps
145 Indicate the number of transfers per second that were
146 issued to the device. Multiple logical requests can be
147 combined into a single I/O request to the device. A
148 transfer is of indeterminate size.
149 rd_sec/s
151 Number of sectors read from the device. The size of a
152 sector is 512 bytes.
153 wr_sec/s
155 Number of sectors written to the device. The size of a
156 sector is 512 bytes.
157 avgrq-sz
159 The average size (in sectors) of the requests that were
160 issued to the device.
161 avgqu-sz
163 The average queue length of the requests that were issued
164 to the device.
165 await
167 The average time (in milliseconds) for I/O requests
168 issued to the device to be served. This includes the time
169 spent by the requests in queue and the time spent servic‐
170 ing them.
171 svctm
173 The average service time (in milliseconds) for I/O
174 requests that were issued to the device.
175 %util
177 Percentage of CPU time during which I/O requests were
178 issued to the device (bandwidth utilization for the
179 device). Device saturation occurs when this value is
180 close to 100%.
181 -e [ hh:mm:ss ]
183 Set the ending time of the report. The default ending time is
184 18:00:00. Hours must be given in 24-hour format. This option
185 can be used only when data are read from or written to a file
186 (options -f or -o ).
187 -f [ filename ]
189 Extract records from filename (created by the -o filename flag).
190 The default value of the filename parameter is the current daily
191 data file, the /var/log/sa/sadd file. The -f option is exclusive
192 of the -o option.
193 -i interval
195 Select data records at seconds as close as possible to the num‐
196 ber specified by the interval parameter.
197 -I { irq | SUM | ALL | XALL }
199 Report statistics for a given interrupt. irq is the interrupt
200 number. Specifying multiple -I irq parameters on the command
201 line will look at multiple independent interrupts. The SUM key‐
202 word indicates that the total number of interrupts received per
203 second is to be displayed. The ALL keyword indicates that sta‐
204 tistics from the first 16 interrupts are to be reported, whereas
205 the XALL keyword indicates that statistics from all interrupts,
206 including potential APIC interrupt sources, are to be reported.
207 -n { DEV | EDEV | NFS | NFSD | SOCK | ALL }
209 Report network statistics.
210 With the DEV keyword, statistics from the network devices are
212 reported. The following values are displayed:
213 IFACE
215 Name of the network interface for which statistics are
216 reported.
217 rxpck/s
219 Total number of packets received per second.
220 txpck/s
222 Total number of packets transmitted per second.
223 rxbyt/s
225 Total number of bytes received per second.
226 txbyt/s
228 Total number of bytes transmitted per second.
229 rxcmp/s
231 Number of compressed packets received per second (for
232 cslip etc.).
233 txcmp/s
235 Number of compressed packets transmitted per second.
236 rxmcst/s
238 Number of multicast packets received per second.
239 With the EDEV keyword, statistics on failures (errors) from the
241 network devices are reported. The following values are dis‐
242 played:
243 IFACE
245 Name of the network interface for which statistics are
246 reported.
247 rxerr/s
249 Total number of bad packets received per second.
250 txerr/s
252 Total number of errors that happened per second while
253 transmitting packets.
254 coll/s
256 Number of collisions that happened per second while
257 transmitting packets.
258 rxdrop/s
260 Number of received packets dropped per second because of
261 a lack of space in linux buffers.
262 txdrop/s
264 Number of transmitted packets dropped per second because
265 of a lack of space in linux buffers.
266 txcarr/s
268 Number of carrier-errors that happened per second while
269 transmitting packets.
270 rxfram/s
272 Number of frame alignment errors that happened per second
273 on received packets.
274 rxfifo/s
276 Number of FIFO overrun errors that happened per second on
277 received packets.
278 txfifo/s
280 Number of FIFO overrun errors that happened per second on
281 transmitted packets.
282 With the NFS keyword, statistics about NFS client activity are
284 reported. The following values are displayed:
285 call/s
287 Number of RPC requests made per second.
288 retrans/s
290 Number of RPC requests per second, those which needed to
291 be retransmitted (for example because of a server time‐
292 out).
293 read/s
295 Number of 'read' RPC calls made per second.
296 write/s
298 Number of 'write' RPC calls made per second.
299 access/s
301 Number of 'access' RPC calls made per second.
302 getatt/s
304 Number of 'getattr' RPC calls made per second.
305 With the NFSD keyword, statistics about NFS server activity are
307 reported. The following values are displayed:
308 scall/s
310 Number of RPC requests received per second.
311 badcall/s
313 Number of bad RPC requests received per second, those
314 whose processing generated an error.
315 packet/s
317 Number of network packets received per second.
318 udp/s
320 Number of UDP packets received per second.
321 tcp/s
323 Number of TCP packets received per second.
324 hit/s
326 Number of reply cache hits per second.
327 miss/s
329 Number of reply cache misses per second.
330 sread/s
332 Number of 'read' RPC calls received per second.
333 swrite/s
335 Number of 'write' RPC calls received per second.
336 saccess/s
338 Number of 'access' RPC calls received per second.
339 sgetatt/s
341 Number of 'getattr' RPC calls received per second.
342 With the SOCK keyword, statistics on sockets in use are
344 reported. The following values are displayed:
345 totsck
347 Total number of used sockets.
348 tcpsck
350 Number of TCP sockets currently in use.
351 udpsck
353 Number of UDP sockets currently in use.
354 rawsck
356 Number of RAW sockets currently in use.
357 ip-frag
359 Number of IP fragments currently in use.
360 The ALL keyword is equivalent to specifying all the keywords
362 above and therefore all the network activities are reported.
363 -o [ filename ]
365 Save the readings in the file in binary form. Each reading is in
366 a separate record. The default value of the filename parameter
367 is the current daily data file, the /var/log/sa/sadd file. The
368 -o option is exclusive of the -f option.
369 -P { cpu | ALL }
371 Report per-processor statistics for the specified processor or
372 processors. Specifying the ALL keyword reports statistics for
373 each individual processor, and globally for all processors. Of
374 the flags which specify the statistics to be reported, only the
375 -u and -I SUM flags are meaningful with the -P flag. Note that
376 processor 0 is the first processor.
377 -p Pretty-print device names. Use this option in conjunction with
379 option -d. By default names are printed as dev m-n where m and
380 n are the major and minor numbers for the device. Use of this
381 option displays the names of the devices as they (should) appear
382 in /dev. Name mappings are controlled by /etc/sysconfig/sys‐
383 stat.ioconf.
384 -q Report queue length and load averages. The following values are
386 displayed:
387 runq-sz
389 Run queue length (number of processes waiting for run
390 time).
391 plist-sz
393 Number of processes and threads in the process list.
394 ldavg-1
396 System load average for the last minute.
397 ldavg-5
399 System load average for the past 5 minutes.
400 ldavg-15
402 System load average for the past 15 minutes.
403 -r Report memory and swap space utilization statistics. The fol‐
405 lowing values are displayed:
406 kbmemfree
408 Amount of free memory available in kilobytes.
409 kbmemused
411 Amount of used memory in kilobytes. This does not take
412 into account memory used by the kernel itself.
413 %memused
415 Percentage of used memory.
416 kbbuffers
418 Amount of memory used as buffers by the kernel in kilo‐
419 bytes.
420 kbcached
422 Amount of memory used to cache data by the kernel in
423 kilobytes.
424 kbswpfree
426 Amount of free swap space in kilobytes.
427 kbswpused
429 Amount of used swap space in kilobytes.
430 %swpused
432 Percentage of used swap space.
433 kbswpcad
435 Amount of cached swap memory in kilobytes. This is mem‐
436 ory that once was swapped out, is swapped back in but
437 still also is in the swap area (if memory is needed it
438 doesn't need to be swapped out again because it is
439 already in the swap area. This saves I/O).
440 -R Report memory statistics. The following values are displayed:
442 frmpg/s
444 Number of memory pages freed by the system per second. A
445 negative value represents a number of pages allocated by
446 the system. Note that a page has a size of 4 kB or 8 kB
447 according to the machine architecture.
448 bufpg/s
450 Number of additional memory pages used as buffers by the
451 system per second. A negative value means fewer pages
452 used as buffers by the system.
453 campg/s
455 Number of additional memory pages cached by the system
456 per second. A negative value means fewer pages in the
457 cache.
458 -s [ hh:mm:ss ]
460 Set the starting time of the data, causing the sar command to
461 extract records time-tagged at, or following, the time speci‐
462 fied. The default starting time is 08:00. Hours must be given
463 in 24-hour format. This option can be used only when data are
464 read from a file (option -f ).
465 -t When reading data from a daily data file, indicate that sar
467 should display the timestamps in the original locale time of the
468 data file creator. Without this option, the sar command displays
469 the timestamps in the user's locale time.
470 -u Report CPU utilization. The following values are displayed:
472 %user
474 Percentage of CPU utilization that occurred while execut‐
475 ing at the user level (application).
476 %nice
478 Percentage of CPU utilization that occurred while execut‐
479 ing at the user level with nice priority.
480 %system
482 Percentage of CPU utilization that occurred while execut‐
483 ing at the system level (kernel).
484 %iowait
486 Percentage of time that the CPU or CPUs were idle during
487 which the system had an outstanding disk I/O request.
488 %steal
490 Show the percentage of time spent in involuntary wait by
491 the virtual CPU or CPUs while the hypervisor was servic‐
492 ing another virtual processor.
493 %idle
495 Percentage of time that the CPU or CPUs were idle and the
496 system did not have an outstanding disk I/O request.
497 Note: On SMP machines a processor that does not have any activ‐
499 ity at all (0.00 for every field) is a disabled (offline) pro‐
500 cessor.
501 -v Report status of inode, file and other kernel tables. The fol‐
503 lowing values are displayed:
504 dentunusd
506 Number of unused cache entries in the directory cache.
507 file-sz
509 Number of used file handles.
510 inode-sz
512 Number of used inode handlers.
513 super-sz
515 Number of super block handlers allocated by the kernel.
516 %super-sz
518 Percentage of allocated super block handlers with regard
519 to the maximum number of super block handlers that Linux
520 can allocate.
521 dquot-sz
523 Number of allocated disk quota entries.
524 %dquot-sz
526 Percentage of allocated disk quota entries with regard to
527 the maximum number of cached disk quota entries that can
528 be allocated.
529 rtsig-sz
531 Number of queued RT signals.
532 %rtsig-sz
534 Percentage of queued RT signals with regard to the maxi‐
535 mum number of RT signals that can be queued.
536 -V Print version number then exit.
538 -w Report system switching activity.
540 cswch/s
542 Total number of context switches per second.
543 -W Report swapping statistics. The following values are displayed:
545 pswpin/s
547 Total number of swap pages the system brought in per sec‐
548 ond.
549 pswpout/s
551 Total number of swap pages the system brought out per
552 second.
553 -x { pid | SELF | ALL }
555 Report statistics for a given process. pid is the process iden‐
556 tification number. The SELF keyword indicates that statistics
557 are to be reported for the sar process itself, whereas the ALL
558 keyword indicates that statistics are to be reported for all the
559 system processes. All these statistics cannot be saved to a
560 file. So this option will be ignored whenever -o option is
561 used. Specifying multiple -x pid parameters on the command line
562 will look at multiple independent processes. At the present
563 time, no more than 256 processes can be monitored simultane‐
564 ously.
565 The following values are displayed:
567 minflt/s
569 Total number of minor faults the process has made per
570 second, those which have not required loading a memory
571 page from disk.
572 majflt/s
574 Total number of major faults the process has made per
575 second, those which have required loading a memory page
576 from disk.
577 %user
579 Percentage of CPU used by the process while executing at
580 the user level (application), with or without nice prior‐
581 ity.
582 %system
584 Percentage of CPU used by the process while executing at
585 the system level (kernel).
586 nswap/s
588 Number of pages from the process address space the system
589 has swapped out per second. This value is always zero
590 with post 2.5 kernels.
591 CPU
593 Processor number to which the process is attached.
594 -X { pid | SELF | ALL }
596 Report statistics for the child processes of the process whose
597 PID is pid . The SELF keyword indicates that statistics are to
598 be reported for the child processes of the sar process itself,
599 whereas the ALL keyword indicates that statistics are to be
600 reported for all the child processes of all the system pro‐
601 cesses. All these statistics cannot be saved to a file. So
602 this option will be ignored whenever -o option is used. Speci‐
603 fying multiple -X pid parameters on the command line will look
604 at multiple independent processes. At the present time, no more
605 than 256 processes can be monitored simultaneously. The follow‐
606 ing values are displayed:
607 cminflt/s
609 Total number of minor faults the child processes have
610 made per second, those which have not required loading a
611 memory page from disk.
612 cmajflt/s
614 Total number of major faults the child processes have
615 made per second, those which have required loading a mem‐
616 ory page from disk.
617 %cuser
619 Percentage of CPU used by the child processes while exe‐
620 cuting at the user level (application), with or without
621 nice priority.
622 %csystem
624 Percentage of CPU used by the child processes while exe‐
625 cuting at the system level (kernel).
626 cnswap/s
628 Number of pages from the child processes address spaces
629 the system has swapped out per second. This value is
630 always zero with post 2.5 kernels.
631 -y Report TTY device activity. The following values are displayed:
633 rcvin/s
635 Number of receive interrupts per second for current
636 serial line. Serial line number is given in the TTY col‐
637 umn.
638 xmtin/s
640 Number of transmit interrupts per second for current
641 serial line.
642 framerr/s
644 Number of frame errors per second for current serial
645 line.
646 prtyerr/s
648 Number of parity errors per second for current serial
649 line.
650 brk/s
652 Number of breaks per second for current serial line.
653 ovrun/s
655 Number of overrun errors per second for current serial
656 line.
657 Note that with recent 2.6 kernels, these statistics can be
659 retrieved only by root.
660
663 The sar command takes into account the following environment variables:
664 S_TIME_FORMAT
667 If this variable exists and its value is ISO then the current
668 locale will be ignored when printing the date in the report
669 header. The sar command will use the ISO 8601 format (YYYY-MM-
670 DD) instead.
671 S_TIME_DEF_TIME
674 If this variable exists and its value is UTC then sar will save
675 its data in UTC time (data will still be displayed in local
676 time). sar will also use UTC time instead of local time to
677 determine the current daily data file located in the /var/log/sa
678 directory. This variable may be useful for servers with users
679 located across several timezones.
680
682 sar -u 2 5
683 Report CPU utilization for each 2 seconds. 5 lines are dis‐
684 played.
685 sar -I 14 -o int14.file 2 10
687 Report statistics on IRQ 14 for each 2 seconds. 10 lines are
688 displayed. Data are stored in a file called int14.file.
689 sar -r -n DEV -f /var/log/sa/sa16
691 Display memory, swap space and network statistics saved in daily
692 data file 'sa16'.
693 sar -A
695 Display all the statistics saved in current daily data file.
696
698 /proc filesystem must be mounted for the sar command to work.
699 On SMP machines sar assumes that CPU #0 is never disabled. Indeed sar
701 uses it to calculate the time interval.
702 All the statistics are not necessarily available, depending on the ker‐
704 nel version used.
705
707 /var/log/sa/sadd
708 Indicate the daily data file, where the dd parameter is a number
709 representing the day of the month.
710 /proc contains various files with system statistics.
712
714 Sebastien Godard (sysstat <at> wanadoo.fr)
715
717 sadc(8), sa1(8), sa2(8), sadf(1), isag(1), mpstat(1), iostat(1),
718 vmstat(8)
719 http://perso.orange.fr/sebastien.godard/
721Linux OCTOBER 2006 SAR(1)