Sar

Monitoring server resources is a crucial part of identifying any bottlenecks and possible issues on your server.

sar stands for “System Activity Reporter” and provides a wide range of metrics related to system usage, including CPU utilization, memory usage, disk I/O, network activity.

on Ubuntu, sar can be installed by following

#install sar
$ sudo apt-get install -y sysstat

# Enable data collecting
sed -i 's/false/true/g' /etc/default/sysstat

# Change the collection interval from every 10 minutes to every 2 minutes
sed -i 's/5-55\/10/*\/2/g' /etc/cron.d/sysstat

# Restart service
$ sudo systemctl start sysstat

sar system service and log location

sar can be run as system service as well,

1. sudo systemctl start sysstat
2. sudo systemctl enable sysstat
3. This will add the required cron jobs so that the system data is collected accordingly. The cron jobs will be added at cat /etc/cron.d/sysstat

Using systemd service, we can easily set sar up to run automatically on your system, store its collected stats in daily files.

On Ubuntu, sar log files will be stored in /var/log/sysstat folder.

Viewing daily reports

To view all sar reports,

$ sar -f /var/log/sysstat/sa07

To filter out start and end time,

$ sar -s 12:00 -e 12:12 -f /var/log/sysstat/sa07

To provide sar options with start and end time,

$ sar -s 12:00 -e 12:12 -B -f /var/log/sysstat/sa07  

Command and options

sar has a lot of arguments and options and basic comman syntax is following,

$ sar -[ options ] time_interval number_of_tines_to_display

$sar --help

Full description is available in sar man page

Here are few examples, geeksforgeeks site has more examples to use sar

Options	Description	output format
sar -u 2 30	-u for all CPU, 2 means that the sar command should run every 2 seconds 30 means that the command should be executed 30 times.	12:14:32 PM CPU %user %nice %system %iowait %steal %idle 12:14:34 PM all 0.00 0.00 0.03 0.00 0.00 99.97 12:14:36 PM all 0.00 0.00 0.03 0.00 0.00 99.97 12:14:38 PM all 0.00 0.00 0.00 0.02 0.00 99.98
sar -r 2 30	-r for memory	12:15:15 PM kbmemfree kbavail kbmemused %memused kbbuffers kbcached kbcommit %commit kbactive kbinact kbdirty 12:15:17 PM 51770940 128790180 934688 0.71 18792 76432800 1471616 1.10 12511540 64247964 20 12:15:19 PM 51770940 128790180 934688 0.71 18792 76432800 1471616 1.10 12511540 64247964 20 12:15:21 PM 51771048 128790296 934472 0.71 18800 76432800 1471616 1.10 12511544 64247964 48
sar -n DEV 4	-n for network interfaces, 4 means that the sar command should run every 2 seconds	12:17:06 PM IFACE rxpck/s txpck/s rxkB/s txkB/s rxcmp/s txcmp/s rxmcst/s %ifutil 12:17:08 PM eno2np1 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 12:17:08 PM eno1np0 19.50 15.50 2.42 1.43 0.00 0.00 1.00 0.00 12:17:08 PM docker0 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 12:17:08 PM enxb03af2b6059f 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 12:17:08 PM lo 5.00 5.00 0.39 0.39 0.00 0.00 0.00 0.00
sar -d	-d command to view block device, disk I/O statistics, including IOPS	12:00:01 PM DEV tps rkB/s wkB/s dkB/s areq-sz aqu-sz await %util 12:02:01 PM dev259-0 1.74 0.10 9.10 0.00 5.28 0.00 3.36 0.31 12:02:01 PM dev8-0 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 12:02:01 PM dev8-16 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 12:02:01 PM dev8-32 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00
sar -b 1 3	I/O Operation Details	12:20:37 PM tps rtps wtps dtps bread/s bwrtn/s bdscd/s 12:20:38 PM 0.00 0.00 0.00 0.00 0.00 0.00 0.00 12:20:39 PM 0.00 0.00 0.00 0.00 0.00 0.00 0.00 12:20:40 PM 0.00 0.00 0.00 0.00 0.00 0.00 0.00 Average: 0.00 0.00 0.00 0.00 0.00 0.00 0.00

sar report into file

# To save the output from a command like this in a file
$ sar -o sarfile 6 2

# To display sarfile
$ sar -f sarfile