YouTip

[ Linux Command Manual](#) * * * ## What is sar Command sar (System Activity Reporter) is a powerful performance monitoring tool in Linux systems, belonging to the sysstat package. It can collect, report, and save various system activity information, including: * CPU Usage * Memory Utilization * I/O Activity * Network Statistics * Process Activity * Device Load, etc. ### 1.1 Advantages of sar Command 1. **Historical Data Analysis**: Can view system status at any point in the past 2. **Comprehensive Monitoring**: Covers all key performance indicators of the system 3. **Low Overhead**: Data collection has minimal impact on system performance 4. **Automation**: Can be configured to automatically collect data regularly * * * ## Installation and Basic Configuration ### 2.1 Installing sysstat Package In most Linux distributions, the sar command needs to be obtained by installing the sysstat package: # Ubuntu/Debian sudo apt-get install sysstat # CentOS/RHEL sudo yum install sysstat # Fedora sudo dnf install sysstat ### 2.2 Enabling Data Collection After installation, you need to enable the data collection service: ## Example # Edit configuration file sudo vi /etc/default/sysstat # Change ENABLED="false" to ENABLED="true" # Restart service sudo systemctl restart sysstat By default, sar collects data every 10 minutes and saves it in the `/var/log/sysstat/` directory. * * * ## Basic Syntax and Common Parameters ### 3.1 Basic Syntax Format sar ### 3.2 Common Parameter Description | Parameter | Description | | --- | --- | | -A | Display all reports | | -u | Display CPU utilization | | -r | Display memory usage | | -b | Display I/O and transfer rate statistics | | -n DEV | Display network device statistics | | -q | Display system load and queue length | | -d | Display disk activity | | -P ALL | Display statistics for each CPU | | -s | Specify start time | | -e | Specify end time | | -f | Read data from specified file | * * * ## Practical Application Examples ### 4.1 Real-time CPU Usage Monitoring ## Example # Refresh every 2 seconds, display 5 times total sar -u 2 5 Output Example: Linux 5.4.0-91-generic (hostname) 03/15/2023 _x86_64_ (4 CPU) 10:30:01 AM CPU %user %nice %system %iowait %steal %idle 10:30:03 AM all 5.12 0.00 1.02 0.51 0.00 93.35 10:30:05 AM all 6.23 0.00 1.34 0.23 0.00 92.20 ### 4.2 Viewing Historical Memory Usage ## Example # View today's memory usage sar -r # View data for specified date (need to specify file) sar -r -f /var/log/sysstat/sa15 # Data for the 15th ### 4.3 Monitoring Disk I/O Activity ## Example # Monitor disk activity, refresh every 1 second, 10 times total sar -d 1 10 ### 4.4 Viewing Network Interface Statistics ## Example # Monitor network interface activity sar -n DEV 1 5 * * * ## Advanced Usage and Tips ### 5.1 Combining Multiple Metrics Monitoring ## Example # Monitor CPU, memory, and disk simultaneously sar -urdb 1 5 ### 5.2 Generating Reports for Specific Time Periods ## Example # View CPU usage from 9 AM to 10 AM sar -u -s 09:00:00 -e 10:00:00 ### 5.3 Saving Output to File ## Example # Save monitoring results to file sar -A 1 10 > system_report.log ### 5.4 Monitoring Specific CPU Core ## Example # Monitor CPU0 usage sar -P 0 1 5 * * * ## Data Interpretation Guide ### 6.1 CPU Indicator Interpretation | Indicator | Meaning | Healthy Range | | --- | --- | --- | | %user | User space CPU usage | <70% | | %system | Kernel space CPU usage | <30% | | %iowait | CPU waiting time for I/O | 20% | ### 6.2 Memory Indicator Interpretation | Indicator | Meaning | | --- | --- | | kbmemfree | Free physical memory (KB) | | kbmemused | Used physical memory (KB) | | %memused | Memory usage rate | | kbbuffers | Memory used by buffers (KB) | | kbcached | Memory used by cache (KB) | ### 6.3 Disk Indicator Interpretation | Indicator | Meaning | | --- | --- | | tps | Transfers per second | | rd_sec/s | Sectors read per second | | wr_sec/s | Sectors written per second | | %util | Device utilization | * * * ## Common Problem Troubleshooting ### 7.1 CPU Bottleneck Identification If `%user` or `%system` consistently exceeds 80%, it may indicate: * Compute-intensive applications * Excessive system calls * Need to optimize code or increase CPU resources ### 7.2 Insufficient Memory Determination When the following conditions occur simultaneously, there may be insufficient memory: * `%memused` consistently exceeds 90% * `kbcached` value is very low * High usage of swap partition (`kbswpused`) ### 7.3 I/O Bottleneck Identification High `%iowait` and high disk `%util` indicate: * Disk I/O has become a bottleneck * May need faster storage devices * Or optimize I/O-intensive operations * * Linux Command Manual](#)