Detailed Guide to the sar Command for System Performance Monitoring

The sar (System Activity Reporter) command can generate reports on file I/O, system calls, disk I/O, CPU efficiency, memory usage, process activity, and IPC-related activities.

Command format: sar [options] [-A] [-o file] t [n] where t is the sampling interval, n the number of samples (default 1), and -o file stores results in binary format.

Common options include:

-A : all reports combined

-u : CPU usage statistics

-v : inode, file and other kernel table statistics

-d : activity per block device

-r : memory and swap usage

-b : I/O and transfer rate statistics

-a : file read/write activity

-c : process creation rate

-R : memory paging statistics

-y : terminal device activity

-w : system swap activity

Example scenarios :

CPU monitoring : sample every 5 seconds for 10 times and save to a binary file. sar -u -o test_sar 5 10

Output fields include CPU (average of all CPUs), %user , %nice , %system , %iowait , %steal , and %idle , with interpretation notes for high I/O wait, low idle, etc.

Inode and file table monitoring : sar -v 5 10

Key fields: dentunusd (unused directory cache entries), file-nr (file handles), inode-nr (inode handles), pty-nr (pseudo‑terminals).

Memory and swap monitoring : sar -r 5 10

Important metrics: kbmemfree , kbmemused , %memused , kbbuffers , kbcached , kbcommit , %commit .

Memory paging monitoring : sar -B 5 10

Outputs include pgpgin/s , pgpgout/s , fault/s , majflt/s , pgfree/s , pgscank/s , pgscand/s , pgsteal/s , and %vmeff .

I/O and transfer rate monitoring : sar -b 5 10

Fields: tps , rtps , wtps , bread/s , bwrtn/s .

Process queue length and load average : sar -q 5 10

Shows runq-sz , plist-sz , ldavg-1 , ldavg-5 , ldavg-15 .

Swap activity monitoring : sar -W 5 10

Provides pswpin/s and pswpout/s .

Device usage monitoring : sar -d 5 10 -p

With -p it prints device names (e.g., sda, hdc). Important metrics: tps , rd_sec/s , wr_sec/s , avgrq-sz , avgqu-sz , await , svctm , %util . High avgqu-sz or %util near 100 % indicates saturation.

To diagnose system bottlenecks, combine relevant options: use sar -u and sar -q for CPU, sar -B , sar -r , sar -W for memory, and sar -b , sar -u , sar -d for I/O.