sar



SAR(1)                        Linux User’s Manual                       SAR(1)




NAME

       sar - Collect, report, or save system activity information.


SYNOPSIS

       sar  [ -A ] [ -b ] [ -B ] [ -c ] [ -d ] [ -H ] [ -h ] [ -i interval ] [
       -q ] [ -r ] [ -R ] [ -t ] [ -u ] [ -v ] [ -V ] [ -w ] [ -W ] [ -y  ]  [
       -n  {  DEV  | EDEV | SOCK | FULL } ] [ -x { pid | SELF | ALL } ] [ -X {
       pid | SELF | ALL } ] [ -I { irq | SUM | ALL | XALL } ] [ -P { cpu | ALL
       }  ]  [  -o [ filename ] | -f [ filename ] ] [ -s [ hh:mm:ss ] ] [ -e [
       hh:mm:ss ] ] [ interval [ count ] ]


DESCRIPTION

       The sar command writes to standard  output  the  contents  of  selected
       cumulative  activity  counters  in the operating system. The accounting
       system, based on the values  in  the  count  and  interval  parameters,
       writes  information  the specified number of times spaced at the speci-
       fied intervals in seconds.  If the interval parameter is set  to  zero,
       the  sar command displays the average statistics for the time since the
       system was started. The default value for the count parameter is 1.  If
       its value is set to zero, then reports are generated continuously.  The
       collected data can also be saved in the file specified by the -o  file-
       name  flag, in addition to being displayed onto the screen. If filename
       is omitted, sar uses the standard system activity daily data file,  the
       /var/log/sa/sadd  file,  where  the  dd parameter indicates the current
       day.

       The sar command extracts and writes to standard output  records  previ-
       ously saved in a file. This file can be either the one specified by the
       -f flag or, by default, the standard system activity daily data file.

       Without the -P flag, the sar command reports system-wide (global  among
       all processors) statistics, which are calculated as averages for values
       expressed as percentages, and as sums otherwise.  If  the  -P  flag  is
       given,  the sar command reports activity which relates to the specified
       processor or processors. If -P ALL is given, the  sar  command  reports
       statistics  for  each  individual processor and global statistics among
       all processors.

       You can select  information  about  specific  system  activities  using
       flags.  Not specifying any flags selects only CPU activity.  Specifying
       the -A flag is equivalent to specifying -bBcdqrRuvwWy -I SUM -n FULL -P
       ALL.

       The  default  version of the sar command (CPU utilization report) might
       be one of the first facilities the user runs to begin  system  activity
       investigation,  because it monitors major system resources. If CPU uti-
       lization is near 100 percent (user + nice + system), the workload  sam-
       pled is CPU-bound.

       If  multiple samples and multiple reports are desired, it is convenient
       to specify an output file for the sar command.  Run the sar command  as
       a background process. The syntax for this is:

       sar -o data.file interval count >/dev/null 2>&1 &

       All  data  is  captured in binary form and saved to a file (data.file).
       The data can then be selectively displayed with the sar  command  using
       the  -f option. Set the count parameter to select records at count sec-
       ond intervals. If this parameter is not set, all the records  saved  in
       the file will be selected.  Collection of data in this manner is useful
       to characterize system usage over a period of time and  determine  peak
       usage hours.

       Note:     The sar command only reports on local activities.



OPTIONS

       -A     This is equivalent to specifying -bBcdqrRuvwWy -I SUM -n FULL -P
              ALL.

       -b     Report I/O and transfer rate statistics. This option works  only
              with  kernels  older  than  2.5.   The following values are dis-
              played:

              tps
                     Total number of transfers per second that were issued  to
                     the  physical  disk.  A transfer is an I/O request to the
                     physical disk. Multiple logical requests can be  combined
                     into  a single I/O request to the disk.  A transfer is of
                     indeterminate size.

              rtps
                     Total number of read requests per second  issued  to  the
                     physical disk.

              wtps
                     Total  number  of write requests per second issued to the
                     physical disk.

              bread/s
                     Total amount of data read from the drive  in  blocks  per
                     second.   Blocks  are equivalent to sectors with 2.4 ker-
                     nels and newer and therefore have a size  of  512  bytes.
                     With older kernels, a block is of indeterminate size.

              bwrtn/s
                     Total  amount  of data written to the drive in blocks per
                     second.

       -B     Report paging statistics. The following values are displayed:

              pgpgin/s
                     Total number of kilobytes the system paged in  from  disk
                     per second.

              pgpgout/s
                     Total  number  of  kilobytes the system paged out to disk
                     per second.

              fault/s
                     Number of page faults (major + minor) made by the  system
                     per  second (post 2.5 kernels only).  This is not a count
                     of page faults  that  generate  I/O,  because  some  page
                     faults can be resolved without I/O.

              majflt/s
                     Number  of  major  faults the system has made per second,
                     those which have required loading a memory page from disk
                     (post 2.5 kernels only).

       -c     Report process creation activity.

              proc/s
                     Total number of processes created per second.

       -d     Report  activity  for  each  block device (kernels 2.4 and newer
              only).  When data is displayed, the device specification dev m-n
              is  generally  used ( DEV column).  m is the major number of the
              device.  With recent kernels (post 2.5), n is the  minor  number
              of  the  device, but is only a sequence number with pre 2.5 ker-
              nels.

              tps
                     Indicate the number of transfers  per  second  that  were
                     issued  to  the device.  Multiple logical requests can be
                     combined into a single  I/O  request  to  the  device.  A
                     transfer is of indeterminate size.

              rd_sec/s
                     Number  of  sectors  read  from the device. The size of a
                     sector is 512 bytes.

              wr_sec/s
                     Number of sectors written to the device. The  size  of  a
                     sector is 512 bytes.

       -e hh:mm:ss
              Set  the  ending  time of the report. The default ending time is
              18:00:00. Hours must be given in 24-hour  format.   This  option
              can  be  used  only when data are read from or written to a file
              (options -f or -o ). Note that if you also use -h option, ending
              time  will have to be given in UTC (Coordinated Universal Time).

       -f filename
              Extract records from filename (created by the -o filename flag).
              The default value of the filename parameter is the current daily
              data file, the /var/log/sa/sadd file. The -f option is exclusive
              of the -o option.

       -h     When   reading  data from a file, print its contents in a format
              that can easily be handled by pattern processing  commands  like
              awk.   The  output  consists  of fields separated by a tab. Each
              record contains the hostname of the host where sar was run,  the
              interval  value  (or  -1  if not applicable), the timestamp (UTC
              value - Coordinated Universal Time) in seconds from  the  epoch,
              the device name (or - if not applicable), the field name and its
              value.

       -H     When  reading data from a file, print its contents in  a  format
              that can easily be ingested by a relational database system. The
              output consists of fields separated by a semicolon. Each  record
              contains  the hostname of the host where sar was run, the inter-
              val value (or -1 if not applicable), the sar timestamp in a form
              easily  acceptable  by  most databases, and additional semicolon
              separated data fields as specified by  other  sar  command  line
              options.   Note  that the timestamp is displayed in UTC (Coordi-
              nated Universal Time) unless option -t is used. In  this  latter
              case, the timestamp is displayed in local time.

       -i interval
              Select  data records at seconds as close as possible to the num-
              ber specified by the interval parameter.

       -I irq | SUM | ALL | XALL
              Report statistics for a given interrupt.  irq is  the  interrupt
              number.  The  SUM  keyword  indicates  that  the total number of
              interrupts received per second is to be displayed. The ALL  key-
              word  indicates that statistics from the first 16 interrupts are
              to be reported, whereas the XALL keyword indicates that  statis-
              tics  from  all  interrupts,  including potential APIC interrupt
              sources, are to be reported.

       -n DEV | EDEV | SOCK | FULL
              Report network statistics.

              With the DEV keyword, statistics from the  network  devices  are
              reported.  The following values are displayed:

              IFACE
                     Name  of  the  network interface for which statistics are
                     reported.

              rxpck/s
                     Total number of packets received per second.

              txpck/s
                     Total number of packets transmitted per second.

              rxbyt/s
                     Total number of bytes received per second.

              txbyt/s
                     Total number of bytes transmitted per second.

              rxcmp/s
                     Number of compressed packets  received  per  second  (for
                     cslip etc.).

              txcmp/s
                     Number of compressed packets transmitted per second.

              rxmcst/s
                     Number of multicast packets received per second.

              With  the EDEV keyword, statistics on failures (errors) from the
              network devices are reported.  The  following  values  are  dis-
              played:

              IFACE
                     Name  of  the  network interface for which statistics are
                     reported.

              rxerr/s
                     Total number of bad packets received per second.

              txerr/s
                     Total number of errors that  happened  per  second  while
                     transmitting packets.

              coll/s
                     Number  of  collisions  that  happened  per  second while
                     transmitting packets.

              rxdrop/s
                     Number of received packets dropped per second because  of
                     a lack of space in linux buffers.

              txdrop/s
                     Number  of transmitted packets dropped per second because
                     of a lack of space in linux buffers.

              txcarr/s
                     Number of carrier-errors that happened per  second  while
                     transmitting packets.

              rxfram/s
                     Number of frame alignment errors that happened per second
                     on received packets.

              rxfifo/s
                     Number of FIFO overrun errors that happened per second on
                     received packets.

              txfifo/s
                     Number of FIFO overrun errors that happened per second on
                     transmitted packets.

              With  the  SOCK  keyword,  statistics  on  sockets  in  use  are
              reported.  The following values are displayed:

              totsck
                     Total number of used sockets.

              tcpsck
                     Number of TCP sockets currently in use.

              udpsck
                     Number of UDP sockets currently in use.

              rawsck
                     Number of RAW sockets currently in use.

              ip-frag
                     Number of IP fragments currently in use.

              The  FULL  keyword  is equivalent to specifying all the keywords
              above and therefore all the network activities are reported.

       -o filename
              Save the readings in the file in binary form. Each reading is in
              a  separate  record. The default value of the filename parameter
              is the current daily data file, the /var/log/sa/sadd  file.  The
              -o option is exclusive of the -f option.

       -P cpu | ALL
              Report  per-processor  statistics for the specified processor or
              processors.  Specifying the ALL keyword reports  statistics  for
              each  individual processor, and globally for all processors.  Of
              the flags which specify the statistics to be reported, only  the
              -u  and  -I SUM flags are meaningful with the -P flag. Note that
              processor 0 is the first processor.

       -q     Report queue length and load averages. The following values  are
              displayed:

              runq-sz
                     Run  queue  length  (number  of processes waiting for run
                     time).

              plist-sz
                     Number of processes in the process list.

              ldavg-1
                     System load average for the last minute.

              ldavg-5
                     System load average for the past 5 minutes.

              ldavg-15
                     System load average for the past 15 minutes.

       -r     Report memory and swap space utilization statistics.   The  fol-
              lowing values are displayed:

              kbmemfree
                     Amount of free memory available in kilobytes.

              kbmemused
                     Amount  of  used  memory in kilobytes. This does not take
                     into account memory used by the kernel itself.

              %memused
                     Percentage of used memory.

              kbbuffers
                     Amount of memory used as buffers by the kernel  in  kilo-
                     bytes.

              kbcached
                     Amount  of  memory  used  to  cache data by the kernel in
                     kilobytes.

              kbswpfree
                     Amount of free swap space in kilobytes.

              kbswpused
                     Amount of used swap space in kilobytes.

              %swpused
                     Percentage of used swap space.

              kbswpcad
                     Amount of cached swap memory in kilobytes.  This is  mem-
                     ory  that  once  was  swapped out, is swapped back in but
                     still also is in the swap area (if memory  is  needed  it
                     doesn’t  need  to  be  swapped  out  again  because it is
                     already in the swap area. This saves I/O).

       -R     Report memory statistics. The following values are displayed:

              frmpg/s
                     Number of memory pages freed by the system per second.  A
                     negative  value represents a number of pages allocated by
                     the system.  Note that a page has a size of 4 kB or 8  kB
                     according to the machine architecture.

              bufpg/s
                     Number  of additional memory pages used as buffers by the
                     system per second.  A negative value  means  fewer  pages
                     used as buffers by the system.

              campg/s
                     Number  of  additional  memory pages cached by the system
                     per second.  A negative value means fewer  pages  in  the
                     cache.

       -s hh:mm:ss
              Set  the  starting  time of the data, causing the sar command to
              extract records time-tagged at, or following,  the  time  speci-
              fied.  The  default starting time is 08:00.  Hours must be given
              in 24-hour format. This option can be used only  when  data  are
              read  from  a  file  (option  -f ). Note that if you also use -h
              option, starting time will have to be given in UTC  (Coordinated
              Universal Time).

       -t     When  reading  data  from  a  daily data file, indicate that sar
              should display the timestamps in the original locale time of the
              data file creator. Without this option, the sar command displays
              the timestamps in the user locale time.   When  this  option  is
              used  together  with  option  -H,  the timestamp is displayed in
              local time instead of UTC (Coordinated  Universal  Time).   This
              option is ignored when option -h is used.

       -u     Report CPU utilization. The following values are displayed:

              %user
                     Percentage of CPU utilization that occurred while execut-
                     ing at the user level (application).

              %nice
                     Percentage of CPU utilization that occurred while execut-
                     ing at the user level with nice priority.

              %system
                     Percentage of CPU utilization that occurred while execut-
                     ing at the system level (kernel).

              %iowait
                     Percentage of time that the CPU or CPUs were idle  during
                     which the system had an outstanding disk I/O request.

              %idle
                     Percentage of time that the CPU or CPUs were idle and the
                     system did not have an outstanding disk I/O request.

       -v     Report status of inode, file and other kernel tables.  The  fol-
              lowing values are displayed:

              dentunusd
                     Number of unused cache entries in the directory cache.

              file-sz
                     Number of used file handles.

              inode-sz
                     Number of used inode handlers.

              super-sz
                     Number of super block handlers allocated by the kernel.

              %super-sz
                     Percentage  of allocated super block handlers with regard
                     to the maximum number of super block handlers that  Linux
                     can allocate.

              dquot-sz
                     Number of allocated disk quota entries.

              %dquot-sz
                     Percentage of allocated disk quota entries with regard to
                     the maximum number of cached disk quota entries that  can
                     be allocated.

              rtsig-sz
                     Number of queued RT signals.

              %rtsig-sz
                     Percentage  of queued RT signals with regard to the maxi-
                     mum number of RT signals that can be queued.

       -V     Print version number and usage then exit.

       -w     Report system switching activity.

              cswch/s
                     Total number of context switches per second.

       -W     Report swapping statistics. The following values are displayed:

              pswpin/s
                     Total number of swap pages the system brought in per sec-
                     ond.

              pswpout/s
                     Total  number  of  swap  pages the system brought out per
                     second.

       -x pid | SELF | ALL
              Report statistics for a given process.  pid is the process iden-
              tification  number.  The  SELF keyword indicates that statistics
              are to be reported for the sar process itself, whereas  the  ALL
              keyword indicates that statistics are to be reported for all the
              system processes.  All these statistics cannot  be  saved  to  a
              file.   So  this  option  will  be ignored whenever -o option is
              used.  At the present time, no more than 256  processes  can  be
              monitored simultaneously.

              The following values are displayed:

              minflt/s
                     Total  number  of  minor  faults the process has made per
                     second, those which have not required  loading  a  memory
                     page from disk.

              majflt/s
                     Total  number  of  major  faults the process has made per
                     second, those which have required loading a  memory  page
                     from disk.

              %user
                     Percentage  of CPU used by the process while executing at
                     the user level (application).

              %system
                     Percentage of CPU used by the process while executing  at
                     the system level (kernel).

              nswap/s
                     Number of pages from the process address space the system
                     has swapped out per second.

              CPU
                     Processor number to which the process is attached.

       -X pid | SELF | ALL
              Report statistics for the child processes of the  process  whose
              PID  is pid .  The SELF keyword indicates that statistics are to
              be reported for the child processes of the sar  process  itself,
              whereas  the  ALL  keyword  indicates  that statistics are to be
              reported for all the child processes  of  all  the  system  pro-
              cesses.   All  these  statistics  cannot be saved to a file.  So
              this option will be ignored whenever -o option is used.  At  the
              present time, no more than 256 processes can be monitored simul-
              taneously.  The following values are displayed:

              cminflt/s
                     Total number of minor faults  the  child  processes  have
                     made  per second, those which have not required loading a
                     memory page from disk.

              cmajflt/s
                     Total number of major faults  the  child  processes  have
                     made per second, those which have required loading a mem-
                     ory page from disk.

              %cuser
                     Percentage of CPU used by the child processes while  exe-
                     cuting at the user level (application).

              %csystem
                     Percentage  of CPU used by the child processes while exe-
                     cuting at the system level (kernel).

              cnswap/s
                     Number of pages from the child process address spaces the
                     system has swapped out per second.

       -y     Report TTY device activity. The following values are displayed:

              rcvin/s
                     Number  of  receive  interrupts  per  second  for current
                     serial line. Serial line number is given in the TTY  col-
                     umn.

              xmtin/s
                     Number  of  transmit  interrupts  per  second for current
                     serial line.

              Note that with recent  2.6  kernels,  these  statistics  can  be
              retrieved only by root.



ENVIRONMENT

       The sar command takes into account the following environment variable:


       S_TIME_FORMAT
              If  this  variable  exists and its value is ISO then the current
              locale will be ignored when printing  the  date  in  the  report
              header.   The sar command will use the ISO 8601 format (YYYY-MM-
              DD) instead.



EXAMPLES

       sar -u 2 5
              Report CPU utilization for each 2  seconds.  5  lines  are  dis-
              played.

       sar -I 14 -o int14.file 2 10
              Report  statistics  on  IRQ  14 for each 2 seconds. 10 lines are
              displayed.  Data are stored in a file called int14.file.

       sar -r -n DEV -f /var/log/sa/sa16
              Display memory, swap space and network statistics saved in daily
              data file ’sa16’.

       sar -A
              Display all the statistics saved in current daily data file.


BUGS

       /proc filesystem must be mounted for the sar command to work.

       All the statistics are not necessarily available, depending on the ker-
       nel version used.


FILES

       /var/log/sa/sadd
              Indicate the daily data file, where the dd parameter is a number
              representing the day of the month.

       /proc contains various files with system statistics.


AUTHOR

       Sebastien Godard (sysstat <at> wanadoo.fr)


SEE ALSO

       sadc(8), sa1(8), sa2(8), isag(1), mpstat(1), iostat(1), vmstat(8)

       http://perso.wanadoo.fr/sebastien.godard/



Linux                              JUNE 2004                            SAR(1)

Man(1) output converted with man2html