linux server administration/sar

From Wikiversity
Jump to navigation Jump to search

sar (System Activity Report) is a system utility command used to collect and report different metrics such us system load, CPU activity, memory (sar -r), paging (sar -B), swap (sar -S), disk (sar -d), device load and network. It is extremely useful in analyzing current and recent recorded system performance. Most Linux distributions provide sar utility binary in the sysstat package. You will also find sar in Solaris, AIX, HP-UX but not in MacOs or FreeBSD.

Installation[edit | edit source]

One line command for installation and basic configuration for collecting :

  • Debian/Ubuntu:
apt-get -y install sysstat; sed -i 's/ENABLED="false"/ENABLED="true"/g' /etc/default/sysstat && service sysstat restart && sar
Optionally modify collection interval in: /etc/cron.d/sysstat
Optionally modify collection options in (SADC_OPTIONS="-S XALL"): /etc/sysstat/sysstat (man sadc)
  • Redhat/Oracle Linux/AWS AMI:
yum -y install sysstat && service sysstat start

Installing sar Debian, you have to install sysstat package that includes sar and some other performance tools:

  • apt-get -y install sysstat
  • Checking installation: dpkg -l sysstat
  • Binaries installed in /usr/bin/ directory: dpkg -L sysstat | grep "/usr/bin". Sysstat package contains sar and some other utilities.
  • Installing sysstat using Ansible
/usr/bin/sadc - System Activity Data Collector, a backend to the sar command. Writes binary log of kernel data to the /var/log/sa/saXX file, where the XX parameter indicates the current day
/usr/bin/sadf - System Activity Data Formatter.        Display data collected by sar in multiple formats.
/usr/bin/sar.sysstat  (sar is a symbolink link to this binary)
  • Config files:
/etc/cron.d/sysstat // Collection interval defined in cron configuration
Data directory: /var/log/sysstat
cat /etc/sysconfig/sysstat
cat /etc/cron.d/sysstat

Activation in Debian[edit | edit source]

  • To start collection data modify file /etc/default/sysstat, changing text disabled by enabled: vi /etc/default/sysstat
  • service sysstat restart (sysstat written with two "ss" do not misspell with systat with just one "s")

Modifying number of days to keep and some other options are done in /etc/sysstat/sysstat file. By default Debian collect files for HISTORY=7 7 days.

Configuration in Debian/Ubuntu[edit | edit source]

Main Configuration file: /etc/sysstat/sysstat[edit | edit source]

/etc/sysstat/sysstat Everything configured in this file, including data collection (sadc) options, except collection interval configured in crontab: /etc/cron.d/sysstat


By default configuration SADC_OPTIONs is configure to SADC_OPTIONS="-S DISK" you can change SADC_OPTIONS default option to collect all data: SADC_OPTIONS from -S DISK to -S XALL. See man sadc for more options: { DISK | INT | IPV6 | POWER | SNMP | XDISK | ALL | XALL [,...] }.

Collection interval configuration[edit | edit source]

To change for every 10 minutes to every 2 minutes or every minute, modify cron job in file: /etc/cron.d/sysstat

5-55/10 * * * * root command -v debian-sa1 > /dev/null && debian-sa1 1 1
Every 2 minutes
*/2 * * * * root command -v debian-sa1 > /dev/null && debian-sa1 1 1
Every minute
* * * * * root command -v debian-sa1 > /dev/null && debian-sa1 1 1

Usage[edit | edit source]

System activity collection is provided by 4 programs, two binaries sar,sadc and two shell scriptssa1sa2.


  • /usr/bin/sar -- reporting utility -- it is a link to /usr/bin/sar.sysstat
  • /usr/lib64/sa/sadc -- System activity data collector binary, a backend to the sar command. Writes binary log of kernel data to the /var/log/sa/sadd file, where the dd parameter indicates the current day


  • /usr/lib64/sa/sa1
  • /usr/lib64/sa/sa2

Basic Usage[edit | edit source]

  • Displays collected system activity, execute sar, you will have to wait some time, depending on your configuration, for getting collected information:
sar -A Report all collected date


sar -r


sar -d To report disk activity. See also iostat -x.
sar -F To report disk and inodes usage. Requires sadc option in /etc/sysstat/sysstat -S XDISK or -S XALL activated.


sar -n ALL To show network data collected

power management

sar -m ALL To show power management data collected including cpu temperature (Requires sensors/lm-sensors utility to be installed)

Activities[edit | edit source]

  1. Install and configure sar to record system activity every 5 minutes
  2. Read sysstat changelog:

See also[edit | edit source]