Mastering sar: Diagnose CPU, Memory, I/O, and Network Issues with sysstat

Why Use sar for Server Troubleshooting

When users report slow access on a specific port, and the database itself shows no errors, the next step is to examine server metrics. The sysstat package, especially the sar tool, offers comprehensive performance monitoring for such cases.

Installing sysstat

Two common installation methods:

<code>sudo yum install sysstat</code>

<code>git clone git://github.com/sysstat/sysstat</code>

Tools Included in sysstat

sysstat provides several utilities:

iostat : monitors I/O load of system devices.

mpstat : shows CPU status in multi‑CPU environments.

pidstat : reports resource usage of all or specific processes.

sar : a comprehensive system activity reporter covering CPU, memory, I/O, network, and more.

Sar Overview

Sar (System Activity Reporter) samples the current state of the system and reports on file reads/writes, system calls, disk I/O, CPU efficiency, memory usage, process activity, and IPC.

Key Features

Continuous sampling with low overhead.

Results can be saved to files for later analysis.

Rich options and powerful functionality.

Sar Statistics Categories

Sar can report on a wide range of metrics, including disk I/O, CPU, memory, virtual memory, network, process creation, interrupts, NFS activity, socket usage, queue and load, kernel tables, TTY activity, and filesystem utilization.

1. Troubleshooting CPU Issues

Use -u or -p to report CPU statistics. Important fields:

%user : CPU time spent in user mode.

%nice : CPU time for nice‑adjusted processes.

%system : CPU time spent in kernel mode.

%iowait : Time waiting for I/O.

%steal : Time stolen by the hypervisor.

%idle : Idle CPU time.

High %iowait indicates I/O bottlenecks; low %idle suggests CPU saturation.

2. Troubleshooting Memory Issues

Use -r to report memory and swap usage. Key fields:

kbmemfree : Free memory (KB).

kbmemused : Used memory (KB), excluding kernel buffers.

%memused : Percentage of memory used.

kbbuffers and kbcached : Kernel buffers and cache.

kbswpfree / kbswpused : Swap space free/used.

%swpused : Swap usage percentage.

3. Troubleshooting I/O Issues

Use -b (or -p ) to display I/O and disk transfer rates. Important metrics:

tps : Transfers per second.

bread/s / bwrtn/s : Blocks read/written per second.

await : Average request latency (ms).

%util : Device utilization percentage; values near 100% indicate a saturated device.

4. Troubleshooting Network Traffic

Use -n DEV to report network statistics. Key fields:

IFACE : Network interface name.

rxerr/s / txerr/s : Receive/transmit errors per second.

coll/s : Collisions per second (half‑duplex only).

rxdrop/s / txdrop/s : Packets dropped due to full buffers.

rxfram/s , rxfifo/s , txfifo/s : Frame alignment and FIFO errors.

Focusing on the -n DEV output provides a clear view of network traffic issues.

Conclusion

The sar tool within sysstat offers a versatile set of commands for diagnosing performance problems across CPU, memory, I/O, and network layers. Exploring its full parameter set can further enhance server monitoring and troubleshooting capabilities.