Examples of using SAR command for system monitoring in Linux

Examples of using SAR command for system monitoring in Linux

In this tutorial we will review the examples of using SAR command for system monitoring in Linux server.

The main thing that we need to understand regarding SAR is that, everything is done using a cron. By default in many Linux distribution you will have a file named /etc/cron.d/sysstat. Some more command to use SAR command for system monitoring:

Individual Block Device I/O Activities

To identify the activities by the individual block devices use following command.

# sar -d 1 1

Output:

Linux 2.6.32-504.1.3.el6.x86_64 (node.linuxmasterswiki.com)    06/18/2015      _x86_64_        (4 CPU)

01:29:29 PM       DEV       tps  rd_sec/s  wr_sec/s  avgrq-sz  avgqu-sz     await     svctm     %util
01:29:30 PM    dev8-0      0.00      0.00      0.00      0.00      0.00      0.00      0.00      0.00
01:29:30 PM   dev8-16      0.00      0.00      0.00      0.00      0.00      0.00      0.00      0.00
01:29:30 PM    dev9-2      0.00      0.00      0.00      0.00      0.00      0.00      0.00      0.00
01:29:30 PM    dev9-0      0.00      0.00      0.00      0.00      0.00      0.00      0.00      0.00
01:29:30 PM    dev9-1      0.00      0.00      0.00      0.00      0.00      0.00      0.00      0.00

Average:          DEV       tps  rd_sec/s  wr_sec/s  avgrq-sz  avgqu-sz     await     svctm     %util
Average:       dev8-0      0.00      0.00      0.00      0.00      0.00      0.00      0.00      0.00
Average:      dev8-16      0.00      0.00      0.00      0.00      0.00      0.00      0.00      0.00
Average:       dev9-2      0.00      0.00      0.00      0.00      0.00      0.00      0.00      0.00
Average:       dev9-0      0.00      0.00      0.00      0.00      0.00      0.00      0.00      0.00
Average:       dev9-1      0.00      0.00      0.00      0.00      0.00      0.00      0.00      0.00

Understanding the output of SAR command

  • DEV: Its indicates the specific block device. dev8-0 means a block device with 8 as major number, and 0 as minor number
  • tps: Indicate the number of transfers per second.
  • rd_sec/s: Number of sectors read from the device.
  • wr_sec/s: Number of sectors written to the device.
  • avgrq-sz: The normal size (in sector) of the requests that were issued to the device.
  • avgqu-sz: The average queue length of the requests that were issued to the device.
  • await: The average time (in milliseconds) for I/O requests issued to the device to be wait.
  • svctm: The average service time (in milliseconds) for I/O requests that were issued to the device..
  • %util: Percentage of CPU time during which I/O requests were issued to the device.

Taking after are few of varieties:

  • sar -d
  • sar -p -d 1 1
  • sar -d 1 3
  • sar -d -f /var/log/sa/sa10
  • sar -p -d

Display context switch per second

This reports the aggregate number of processes created every second, and aggregate number of setting switches every second.

# sar -w 1 3

Output:

Linux 2.6.32-504.1.3.el6.x86_64 (node.linuxmasterswiki.com)    06/18/2015      _x86_64_        (4 CPU)

02:58:15 PM    proc/s   cswch/s
02:58:16 PM      1.00    451.00
02:58:17 PM      0.00    411.11
02:58:18 PM      1.00    506.00
02:58:19 PM      0.00    609.00
Average:         0.50    494.49

Understanding the output of SAR command

  • proc/s: Total number of tasks created per second.
  • cswch/s: Total number of context switches per second.

Taking after are few of varieties:

  • sar -w
  • sar -w 1 3
  • sar -w -f /var/log/sa/sa10

Reports run queue and load average

This reports the run queue size and load average. Use following command to check,

# sar -q 1 2

Output:

Linux 2.6.32-504.1.3.el6.x86_64 (node.linuxmasterswiki.com)    06/18/2015      _x86_64_        (4 CPU)

03:02:14 PM   runq-sz  plist-sz   ldavg-1   ldavg-5  ldavg-15
03:02:15 PM         0       429      0.17      0.38      0.55
03:02:16 PM         0       429      0.17      0.38      0.55
Average:            0       429      0.17      0.38      0.55

Understanding the output of SAR command

  • runq-sz: Run queue length.
  • plist-sz: Number of tasks in the task list.
  • ldavg-1: System load average for the last minute.
  • ldavg-5: System load average for the past 5 minute.
  • ldavg-15: System load average for the past 15 minute.

Taking after are few of varieties:

  • sar -q
  • sar -q 1 3
  • sar -q -f /var/log/sa/sa10

Report network statistics

This reports different system measurements. For instance: number of packets got transmitted through the network card, statistics of packet failure etc.

sar -n KEYWORD

KEYWORD can be one of the following:

  • DEV: Displays network devices vital statistics for eth0, eth1, etc.,
  • EDEV: Display network device failure statistics
  • NFS: Displays NFS client activities
  • NFSD: Displays NFS server activities
  • SOCK: Displays sockets in use for IPv4
  • IP: Displays IPv4 network traffic
  • EIP: Displays IPv4 network errors
  • ICMP: Displays ICMPv4 network traffic
  • EICMP: Displays ICMPv4 network errors
  • TCP: Displays TCPv4 network traffic
  • ETCP: Displays TCPv4 network errors
  • UDP: Displays UDPv4 network traffic
  • SOCK6, IP6, EIP6, ICMP6, UDP6 are for IPv6
  • ALL: This displays all of the above information. The output will be very long.
# sar -n DEV 1 1

Output:

Linux 2.6.32-504.1.3.el6.x86_64 (node.linuxmasterswiki.com)    06/18/2015      _x86_64_        (4 CPU)

03:12:43 PM     IFACE   rxpck/s   txpck/s    rxkB/s    txkB/s   rxcmp/s   txcmp/s  rxmcst/s
03:12:44 PM        lo      0.00      0.00      0.00      0.00      0.00      0.00      0.00
03:12:44 PM      eth0     41.00     23.00     57.88      1.66      0.00      0.00      4.00
03:12:44 PM      eth1      0.00      0.00      0.00      0.00      0.00      0.00      0.00

Average:        IFACE   rxpck/s   txpck/s    rxkB/s    txkB/s   rxcmp/s   txcmp/s  rxmcst/s
Average:           lo      0.00      0.00      0.00      0.00      0.00      0.00      0.00
Average:         eth0     41.00     23.00     57.88      1.66      0.00      0.00      4.00
Average:         eth1      0.00      0.00      0.00      0.00      0.00      0.00      0.00

Report SAR Data Using Start Time

When you see historic sar information from the /var/log/sa/saXX file using “sar -f” option, it shows all the sar information for that particular day beginning from 12:00 a.m for that day.

Using “-s hh:mi:ss” option, you can determine the begin time. Case in point, in the event that you indicate “sar -s 02:00:00″, it will show the sar information beginning from 02 AM as shown below:

# sar -q -f /var/log/sa/sa17 -s 02:10:01

Output:

Linux 2.6.32-504.1.3.el6.x86_64 (node.linuxmasterswiki.com)    06/17/2015      _x86_64_        (4 CPU)

02:10:02 AM   runq-sz  plist-sz   ldavg-1   ldavg-5  ldavg-15
02:20:01 AM        11       402      0.22      0.47      0.58
02:30:01 AM        11       399      0.30      0.57      0.61
02:40:01 AM        13       402      0.21      0.45      0.54
02:50:01 AM        11       399      0.19      0.45      0.51
03:00:01 AM        12       406      0.59      0.53      0.49
...

If you want to see the report of any particular time then we can do it using following command:

# sar -q -f /var/log/sa/sa17 -s 02:10:01 -e 03:20:01 

Output:

Linux 2.6.32-504.1.3.el6.x86_64 (node.linuxmasterswiki.com)    06/17/2015      _x86_64_        (4 CPU)

02:10:02 AM   runq-sz  plist-sz   ldavg-1   ldavg-5  ldavg-15
02:20:01 AM        11       402      0.22      0.47      0.58
02:30:01 AM        11       399      0.30      0.57      0.61
02:40:01 AM        13       402      0.21      0.45      0.54
02:50:01 AM        11       399      0.19      0.45      0.51
03:00:01 AM        12       406      0.59      0.53      0.49
03:10:01 AM        11       404      0.16      0.42      0.48
03:20:01 AM        11       406      0.14      0.34      0.44
Average:           11       403      0.26      0.46      0.52

Reference Articles:

How to install and configure SAR on CentOS/RHEL
How to use SAR to Monitor System Performance in Red Hat Enterprise

Was this Tutorial helpful? Help others share on Facebook, Twitter, and Google Plus!

 
Enjoyed this video?
Examples of using SAR command for system monitoring in Linux
"No Thanks. Please Close This Box!"