Back to Commands

sar

systemLinux/Unix

The sar command is one of the most frequently used commands in Linux/Unix-like operating systems. sar Collect, report, or save system activity information

See Examples View Syntax

Quick Reference

Command Name:

sar

Category:

system

Platform:

Linux/Unix

Basic Usage:

sar [options] [arguments]

Common Use Cases

Syntax

sar [options] [interval [count]]

Options

Option	Description
`-A`	Report all statistics (equivalent to -bBdHqrRSuvwWy -I SUM -I XALL -n ALL -P ALL)
`-b`	Report I/O and transfer rate statistics
`-B`	Report paging statistics
`-d`	Report activity for each block device
`-e [ hh:mm:ss ]`	Set the ending time of the report
`-f [ filename ]`	Extract records from filename (created by -o option)
`-h`	Display help message and exit
`-H`	Report hugepages utilization statistics
`-i interval`	Select records at seconds as close as possible to interval
`-I { int \| SUM \| ALL \| XALL }`	Report interrupts statistics
`-j { ID \| LABEL \| PATH \| UUID \| ... }`	Display persistent device names
`-n { keyword [,...] \| ALL }`	Report network statistics (keywords: DEV, EDEV, NFS, NFSD, SOCK, IP, EIP, ICMP, EICMP, TCP, ETCP, UDP, SOCK6, IP6, EIP6, ICMP6, EICMP6, UDP6)
`-o [ filename ]`	Save readings in the file in binary form
`-P { cpu \| ALL }`	Report per-processor statistics
`-q`	Report queue length and load averages
`-r`	Report memory utilization statistics
`-R`	Report memory statistics
`-s [ hh:mm:ss ]`	Set the starting time of the report
`-S`	Report swap space utilization statistics
`-u [ ALL ]`	Report CPU utilization (default)
`-v`	Report inode, file and other kernel tables statistics
`-V`	Print version information and exit
`-w`	Report task creation and system switching activity
`-W`	Report swapping statistics
`-y`	Report TTY device activity
`-z`	Display statistics with zero values

Examples

How to Use These Examples

The examples below show common ways to use the sar command. Try them in your terminal to see the results. You can copy any example by clicking on the code block.

# Basic Examples Basic

sar

Display CPU usage statistics.

sar 5 3

Display CPU statistics every 5 seconds, 3 times.

# Advanced Examples Advanced

sar -u Show detailed CPU utilization. sar -r Display memory utilization statistics. sar -b Show I/O and transfer rate statistics. sar -n DEV Display network statistics for all interfaces. sar -q Show run queue and load average statistics. sar -d Display block device activity statistics. sar -A Show all statistics. sar -f /var/log/sa/sa20 Read system activity data from a specific file (for day 20). sar -s 14:00:00 -e 15:00:00 Show data between 2:00 PM and 3:00 PM for the current day. sar -o output.file 1 10 Save raw data to output.file, collecting every 1 second for 10 samples.

Try It Yourself

Practice makes perfect! The best way to learn is by trying these examples on your own system with real files.

Understanding Syntax

Pay attention to the syntax coloring: commands, options, and file paths are highlighted differently.

Notes

The `sar` (System Activity Reporter) command is a powerful performance monitoring tool that collects, reports, and saves system activity information. It's part of the sysstat package available on most Linux distributions and provides comprehensive insights into system performance across various resources. What makes `sar` particularly valuable is its ability to not only display real-time system statistics but also to retrieve historical performance data from log files. The system typically runs the `sadc` (system activity data collector) daemon in the background through cron jobs, which collects and stores performance metrics throughout the day in files under `/var/log/sa/` or `/var/log/sysstat/` directories. Key features of the `sar` command include: 1. Comprehensive Monitoring: Covers virtually all aspects of system performance, including CPU, memory, disk I/O, network, paging, swapping, and process statistics. 2. Historical Data Analysis: Allows retrieval and analysis of past performance data, which is crucial for troubleshooting intermittent issues or understanding performance trends over time. 3. Custom Data Collection: Supports configurable collection intervals and durations, enabling both short-term detailed analysis and long-term trending. 4. Data Persistence: Can save collected metrics to binary files for later analysis or export to other tools. 5. Flexible Output: Offers various report formats tailored to specific subsystems and resources. System administrators and performance analysts typically use `sar` for: - Identifying performance bottlenecks across CPU, memory, disk, or network resources - Tracking system load patterns throughout the day or week - Capacity planning and trend analysis - Troubleshooting performance degradation issues - Validating system performance after hardware or software changes - Establishing performance baselines for normal operation The `sar` command works with two primary modes of operation: 1. Real-time monitoring: When run with an interval and count parameter (e.g., `sar 5 10`), it collects and displays fresh data at the specified intervals. 2. Historical data retrieval: When used with the `-f` option, it reads previously collected data from the specified file. The sysstat package configuration (usually in `/etc/sysstat/sysstat` or `/etc/default/sysstat`) determines how often data is collected and how long it's retained, allowing for customization based on system requirements and storage constraints.

Related Commands

These commands are frequently used alongside sar or serve similar purposes:

Explore All Commands

Use Cases

Learn By Doing

The best way to learn Linux commands is by practicing. Try out these examples in your terminal to build muscle memory and understand how the sar command works in different scenarios.

See Examples Try Lab Exercises

$ sar

View All Commands