sar command (Part I) : All you need to know with examples

Learn System Activity Report sar command with real world scenario examples. Understand command’s log files, execution and different usage.

SAR ! System Activity Report! sar command is second best command used to check system performance or utilization after top command. From man page, ‘The sar command writes to standard output the contents of selected cumulative activity counters in the operating system. The accounting system, based on
the values in the count and interval parameters, writes information the specified number of times spaced at the specified intervals in seconds.’ No doubt this is the best performance monitoring tool to be used for any sysadmin.

Read next part of sar tutorial :

• sar command : CPU and Memory reporting (part II)
• sar command : Disk and network reporting (part III)

Command log file management:

sar keep collecting system resource utilization and store it in binary files. These files are called datafiles and those are located in /var/log/sa/saXX path where XX is data in dd format. So this could be your one of the location to check when you are troubleshooting file system utilization.

Log files are binary hence can be read only with sar using -f option. Normal sar command shows you data in real time when executed. If you need to check historic data you need to use -f option and provide path of particular datafile.

In above example, when executed it will run for 23 iterations (we will see what it is, in later part of this post) for 2 seconds each and show you output which is in real time. Lets see -f option :

In above example, we ran sar command but on a datafile /var/log/sa/sa15. Hence data is being read from older/historic datafile which is not real time. File’s first entry is always treats as first iteration and further on data is displayed according to command arguments. Hence you can see first entry is being of 12AM.

Another beauty of this command for log management is you can save real time command output in a log file of your choice. Lets say you need to share output of specific time of monitoring then you can save output in log file and can share. In this way you dont have to share complete day datafile. You have to use -o option along with file path of your choice.

In above example you can see output is being displayed on terminal as well as in a file provided in command options. Note that this file is also an binary file only.

Command Intervals and Iterations :

This command takes these two arguments which will defines the time factors of output.

Interval being the time in seconds between two iterations of output samples. Normally selected as 2,5,10 seconds. Iteration or count being the number of samples to be taken after interval of defined seconds. So for a command which says “sar 2 5” means 2 interval and 5 iterations i.e. take 5 samples separated by 2 seconds each. i.e. if command is fired at 12:00:00 then output will include samples for times 12:00:02, 12:00:04 till 12:00:10. Check any above example and you will figure out how it works.

If the interval parameter is set to zero, the sar command displays the average statistics for the time since the system was started. If the iterations parameter is specified without the count parameter, then reports are generated continuously as shown below.

We will see useful monitoring example of this command in next post.