Learn System Activity Report sar command with real-world scenario examples. Understand the command’s log files, execution, and different usage.
SAR ! System Activity Report! sar command is the second-best command used to check system performance or utilization after top command. From the man page, ‘The sar command writes to standard output the contents of selected cumulative activity counters in the operating system. The accounting system, based on
the values in the count and interval parameters, writes information the specified number of times spaced at the specified intervals in seconds.’ No doubt this is the best performance monitoring tool to be used for any sysadmin.
Read next part of sar tutorial :
Command log file management:
sar keep collecting system resource utilization and store it in binary files. These files are called datafiles and those are located in /var/log/sa/saXX the path where XX is data in dd format. So this could be one of the locations to check when you are troubleshooting file system utilization.
# ll /var/log/sa
total 29024
-rw-r--r-- 1 root root 494100 Dec 1 23:50 sa01
-rw-r--r-- 1 root root 494100 Dec 2 23:50 sa02
-rw-r--r-- 1 root root 494100 Dec 3 23:50 sa03
-rw-r--r-- 1 root root 494100 Dec 4 23:50 sa04
-rw-r--r-- 1 root root 494100 Dec 5 23:50 sa05
-rw-r--r-- 1 root root 494100 Dec 6 23:50 sa06
-rw-r--r-- 1 root root 494100 Dec 7 23:50 sa07
----- output clipped -----
Log files are binary hence can be read only with sar using -f option. Normal sar command shows your data in real-time when executed. If you need to check historic data you need to use -f option and provide a path of the particular data file.
# sar -u 2 3
Linux 2.6.39-200.24.1.el6uek.x86_64 (testsvr1) 12/19/2016 _x86_64_ (4 CPU)
11:44:29 AM CPU %user %nice %system %iowait %steal %idle
11:44:31 AM all 25.37 0.00 10.12 0.00 0.00 64.50
11:44:33 AM all 25.41 0.00 10.39 0.13 0.00 64.08
11:44:35 AM all 27.84 0.00 11.36 0.12 0.00 60.67
Average: all 26.21 0.00 10.62 0.08 0.00 63.08
In the above example, when executed it will run for 23 iterations (we will see what it is, in later part of this post) for 2 seconds each and show you an output which is in real-time. Let’s see -f option :
# sar -u 2 3 -f /var/log/sa/sa15
Linux 2.6.39-200.24.1.el6uek.x86_64 (testsvr1) 12/15/2016 _x86_64_ (4 CPU)
12:00:01 AM CPU %user %nice %system %iowait %steal %idle
12:10:01 AM all 10.24 0.00 5.18 0.17 0.00 84.41
12:20:01 AM all 11.55 0.00 5.02 0.19 0.00 83.24
12:30:01 AM all 10.79 0.00 4.79 0.17 0.00 84.25
Average: all 10.86 0.00 5.00 0.17 0.00 83.97
In above example, we ran sar command but on a datafile /var/log/sa/sa15. Hence data is being read from older/historic data files which is not real-time. File’s first entry is always treated as the first iteration and further on data is displayed according to command arguments. Hence you can see the first entry is being of 12AM.
Another beauty of this command for log management is you can save real-time command output in a log file of your choice. Let’s say you need to share the output of a specific time of monitoring then you can save the output in the log file and can share. In this way, you don’t have to share complete day datafile. You have to use -o option along with file path of your choice.
# sar -u 2 3 -o /tmp/logfile
Linux 2.6.39-200.24.1.el6uek.x86_64 (testsvr1) 12/19/2016 _x86_64_ (4 CPU)
11:51:42 AM CPU %user %nice %system %iowait %steal %idle
11:51:44 AM all 27.75 0.00 9.88 0.12 0.00 62.25
11:51:46 AM all 26.00 0.00 9.88 0.12 0.00 64.00
11:51:48 AM all 25.53 0.00 10.26 0.00 0.00 64.21
Average: all 26.43 0.00 10.00 0.08 0.00 63.48
# ls -lrt /tmp/logfile
-rw-r--r-- 1 root root 63672 Dec 19 11:51 /tmp/logfile
In the above example, you can see the output is being displayed on the terminal as well as in a file provided in command options. Note that this file is also a binary file only.
Command Intervals and Iterations :
This command takes these two arguments which will define the time factors of output.
Interval is the time in seconds between two iterations of output samples. Normally selected as 2,5,10 seconds. Iteration or count is the number of samples to be taken after an interval of defined seconds. So for a command which says sar 2 5 means 2 interval and 5 iterations i.e. take 5 samples separated by 2 seconds each. i.e. if the command is fired at 12:00:00 then the output will include samples for times 12:00:02, 12:00:04 till 12:00:10. Check any above example and you will figure out how it works.
If the interval parameter is set to zero, the sar command displays the average statistics for the time since the system was started. If the iterations parameter is specified without the count parameter, then reports are generated continuously as shown below.
# sar -u 2
Linux 2.6.39-200.24.1.el6uek.x86_64 (oratest02) 12/19/2016 _x86_64_ (4 CPU)
12:09:28 PM CPU %user %nice %system %iowait %steal %idle
12:09:30 PM all 0.75 0.00 0.50 0.25 0.00 98.50
12:09:32 PM all 0.88 0.00 0.38 0.13 0.00 98.62
12:09:34 PM all 1.12 0.00 1.75 0.25 0.00 96.88
12:09:36 PM all 2.38 0.00 1.38 0.12 0.00 96.12
12:09:38 PM all 14.79 0.00 7.39 0.50 0.00 77.32
------- continuous reports being generated, output clipped -----
We will see useful monitoring example of this command in next post.