SAR(1)

📦
version 12.7.7 · 4 versions
, in ubuntu questing, ubuntu resolute, ubuntu stonking

💖 SAR(1) — Linux User's Manual 💖

okay bestie, this is the manual page for sar, and it's giving "system activity reporter" 🦋 it's part of the Linux User's Manual, so this is the official SAR(1) page, and I'm gonna walk you through every single bit of it ✨

✨ NAME ✨

sar is the tool that collects, reports, or saves system activity information 📊 literally all of it in one place 💅

🎀 SYNOPSIS 🎀

sar [ -A ] [ -B ] [ -b ] [ -C ] [ -D ] [ -d ] [ -F [ MOUNT ] ] [ -H ] [
-h ] [ -p ] [ -r [ ALL ] ] [ -S ] [ -t ] [ -u [ ALL ] ] [ -V ] [ -v ] [
-W ] [ -w ] [ -x ] [ -y ] [ -z ] [ --dec={ 0 | 1 | 2 } ] [
--dev=dev_list ] [ --fs=fs_list ] [ --help ] [ --human ] [
--iface=iface_list ] [ --int=int_list ] [ --pretty ] [ --sadc ] [ -I [
SUM | ALL ] ] [ -P { cpu_list | ALL } ] [ -m { keyword[,...] | ALL } ] [
-n { keyword[,...] | ALL } ] [ -q [ keyword[,...] | ALL ] ] [ -j { SID |
ID | LABEL | PATH | UUID | ... } ] [ -f [ filename ] | -o [ filename ] |
-[0-9]+ ] [ -i interval ] [ -s [ start_time ] ] [ -e [ end_time ] ] ] [
interval [ count ] ]

🌸 DESCRIPTION 🌸

okay so the sar command writes to standard output whatever is inside the selected cumulative activity counters in the operating system 👀 the accounting system uses the count and interval parameters to decide how many times it writes info and how far apart those writes are spaced, in seconds 🫶

if the interval parameter is set to zero, sar shows the average stats for the time since the system was started ⏰ and if you give interval without count, the reports keep coming forever, continuously 🔁

the collected data can also be saved to the file you specify with the -o filename flag, on top of showing up on your screen 💾 if filename is left out, sar uses the standard system activity daily data file (more on that below) ✨ by default, all the data the kernel has available gets saved into the data file 💅

the sar command can also extract records that were saved earlier and write them to standard output 📂 those records live in either the file you pick with the -f flag or, by default, the standard system activity daily data file 💖 you can also pass -1, -2 etc. as an argument to sar to display data from that many days ago 🦋 for example, -1 points at the standard system activity file of yesterday 🌈

so the standard system activity daily data files are named saDD or saYYYYMMDD, where YYYY is the current year, MM is the current month, and DD is the current day 🎀 they're only the default files sar uses when no filename has been explicitly specified, so no need to stress 🫶 when sar writes data to files (with the -o option), it uses saYYYYMMDD if the -D option was also specified, otherwise it uses saDD 💅 and when it's displaying records that were saved earlier, sar looks for the most recent of saDD and saYYYYMMDD and uses that one 👑

the standard system activity daily data files live in /var/log/sysstat by default 📁 but you can totally point somewhere else for them ✨ if you use a directory (instead of a plain file) with the -f or -o options, then that directory gets treated as the directory holding the data files 🧚

without the -P flag, sar reports system-wide stats (global across all processors) 📊 those get calculated as averages for values written as percentages, and as sums for everything else 💜 if you do use the -P flag, sar reports activity for the processor or processors you specify 🔥 and if you give -P ALL, it reports stats for each individual processor AND the global stats across all of them 🤯 offline processors are not displayed, so don't look for them 🙈

you can select info about specific system activities using flags 🎀 if you don't specify any flags, sar only selects CPU activity 💖 specifying the -A flag selects all possible activities, so that's your everything button ✨

the default version of sar (the CPU utilization report) is honestly probably one of the first things you'll run when you start investigating system activity 🔍 because it monitors the major system resources 💅 if CPU utilization is near 100 percent (user + nice + system), the sampled workload is CPU-bound 🔥

if you want multiple samples and multiple reports, it's super convenient to specify an output file for sar 🫶 run sar as a background process, and the syntax for that is:

sar -o datafile interval count >/dev/null 2>&1 &

all the data gets captured in binary form and saved to a file (datafile) 💾 then you can selectively display it with sar using the -f option 🦋 set the interval and count parameters to select count records at interval second intervals ⏱️ if count isn't set, all the records saved in the file get selected 💅 collecting data this way is hugely useful for characterizing system usage over a period of time and figuring out your peak usage hours 📈 literally iconic 👑

Note: the sar command only reports on local activities 🏠 so it won't be telling you about anything happening somewhere else 🙈

💜 OPTIONS 💜

  • -A — this is the everything flag 🌈 it's equivalent to specifying -bBdFHISvwWy -m ALL -n ALL -q ALL -r ALL -u ALL. it also implies specifying -I ALL -P ALL, unless you've explicitly set those on the command line 💖
  • -B — reports paging statistics 📄 these values get displayed:
    • pgpgin/s — total number of kibibytes the system paged in from disk per second 📥
    • pgpgout/s — total number of kibibytes the system paged out to disk per second 📤
    • fault/s — number of page faults (major + minor) made by the system per second 💀 this isn't a count of page faults that generate I/O, because some page faults can be resolved without I/O 🙃
    • majflt/s — number of major faults the system has made per second, meaning the ones that needed a memory page loaded from disk 🫠
    • pgfree/s — number of pages placed on the free list by the system per second ✨
    • pgscank/s — number of pages scanned by the kswapd daemon per second 🧚
    • pgscand/s — number of pages scanned directly per second 👀
    • pgsteal/s — number of pages the system has reclaimed from cache (pagecache and swapcache) per second to satisfy its memory demands 🧹
    • pgprom/s — number of pages promoted (i.e. migrated from slow to fast memory types) by the system per second 🚀
    • pgdem/s — number of pages demoted (i.e. migrated from fast to slow memory types) by the system per second 🍂
  • -b — reports I/O and transfer rate statistics 💫 these values get displayed:
    • tps — total number of transfers per second that were issued to physical devices 🔥 a transfer is an I/O request to a physical device, and multiple logical requests can be combined into a single I/O request to the device 🫶 a transfer is of indeterminate size 🤷‍♀️
    • rtps — total number of read requests per second issued to physical devices 📖
    • wtps — total number of write requests per second issued to physical devices ✍️
    • dtps — total number of discard requests per second issued to physical devices 🗑️
    • bread/s — total amount of data read from the devices in blocks per second 📚 blocks are equivalent to sectors, so they have a size of 512 bytes 💅
    • bwrtn/s — total amount of data written to devices in blocks per second 💾
    • bdscd/s — total amount of data discarded for devices in blocks per second 🍃
  • -C — when reading data from a file, tells sar to display comments that have been inserted by sadc 💬
  • -D — uses saYYYYMMDD instead of saDD as the standard system activity daily data file name 📅 this option only works when it's used alongside the -o option to save data to a file 🫶
  • -d — reports activity for each block device 💿 when data gets displayed, the device name is shown the way it (should) appear in /dev ✨ sar uses data in /sys to figure out the device name from its major and minor numbers 🔎 if that name resolution fails, sar falls back to the name mapping controlled by the /etc/sysstat/sysstat.ioconf file 🗺️ persistent device names can also be printed if the -j option is used (see below) 🏷️ stats for all devices are displayed unless you give a restricted list with the --dev= option (see its entry) 📋 heads up: disk activity depends on sadc's options -S DISK and -S XDISK being collected 🚨 these values get displayed:
    • tps — total number of transfers per second that were issued to physical devices 🔥 a transfer is an I/O request to a physical device, multiple logical requests can be merged into one, and a transfer is of indeterminate size 🫶
    • rkB/s — number of kibibytes read from the device per second 📖
    • wkB/s — number of kibibytes written to the device per second ✍️
    • dkB/s — number of kibibytes discarded for the device per second 🗑️
    • areq-sz — the average size (in kibibytes) of the I/O requests that were issued to the device 📏
      • Note: in previous versions, this field was known as avgrq-sz and was expressed in sectors 🙈
    • aqu-sz — the average queue length of the requests that were issued to the device 🧍‍♀️🧍‍♀️🧍‍♀️
      • Note: in previous versions, this field was known as avgqu-sz 🕰️
    • await — the average time (in milliseconds) for I/O requests issued to the device to be served ⏳ this includes the time the requests spend in the queue AND the time spent servicing them 💀
    • %util — percentage of elapsed time during which I/O requests were issued to the device (the bandwidth utilization for the device) 📊 device saturation happens when this value is close to 100% for devices serving requests serially 🔥 but for devices serving requests in parallel, like RAID arrays and modern SSDs, this number does NOT reflect their performance limits 🙅‍♀️
  • --dec={ 0 | 1 | 2 } — specifies the number of decimal places to use (0 to 2, default value is 2) 🔢
  • --dev=dev_list — specifies the block devices whose statistics should be displayed by sar 💿 dev_list is a list of comma-separated device names 🫶

-e [ hh:mm[:ss] ] / -e [ seconds_since_the_epoch ] ✨

  • -e [ hh:mm[:ss] ], -e [ seconds_since_the_epoch ] — this one sets when the report ends 🕕 The default ending time is 18:00:00. You can give hours in 24-hour format, or as seconds since the epoch (a 10 digit number) 🧮 Only really matters when you're reading from or writing to a file (-f or -o) 📁
  • -F [ MOUNT ] — show stats for the filesystems that are currently mounted 💾 Pseudo-filesystems get ignored, no drama 🙅‍♀️ At the very end, sar drops a summary of all of them. Pass the MOUNT keyword and it reports the mountpoint instead of the filesystem device 🗺️ You get stats for every filesystem unless you narrow it down with --fs= (check that option's entry 👀). Also, filesystem stats only show up if sadc was run with its -S XDISK option 🔥

The following values are displayed:

  • MBfsfree — total free space in mebibytes, including the stuff only the privileged user can touch 🔓
  • MBfsused — total space used in mebibytes 📦
  • %fsused — percentage of filesystem space used, as a privileged user sees it 👑
  • %ufsused — percentage of filesystem space used, as an unprivileged user sees it 🙋‍♀️
  • Ifree — total number of free file nodes (inodes) in the filesystem 🆓
  • Iused — total number of file nodes used in the filesystem 📊
  • %Iused — percentage of file nodes used in the filesystem 💯
  • -f [ filename ] — pull records out of filename (the one you made with -o filename) 🗂️ If you don't give a name, it defaults to the current standard system activity daily data file 📅 If filename is a directory instead of a plain file, sar treats it as the folder where the standard daily data files live 🗃️ Heads up: -f and -o can't be used together, they're exclusive 🙅‍♀️
  • --fs=fs_list — pick which filesystems sar should show stats for 🎯 fs_list is a comma-separated list of filesystem names or mountpoints 🧾
  • -H — report hugepages utilization stats 🧠 The following values are displayed:
    • kbhugfree — amount of hugepages memory in kibibytes that hasn't been allocated yet 🆗
    • kbhugused — amount of hugepages memory in kibibytes that has been allocated 🙌
    • %hugused — percentage of total hugepages memory that's been allocated 📈
    • kbhugrsvd — amount of reserved hugepages memory in kibibytes 🔒
    • kbhugsurp — amount of surplus hugepages memory in kibibytes 🌊
  • -h — this is the same as typing --pretty --human 🫶
  • --help — shows a short help message, then exits 🆘
  • --human — prints sizes in a human readable format, like 1.0k or 1.2M 🍓 The units this gives you override any other default units tied to the metrics, like kibibytes or sectors. Main character energy ✨
  • -I [ SUM | ALL ] — report interrupt stats 🌩️ You get the number of interrupts per second, either for a given processor or across all processors 🖥️ You can narrow it to a list of interrupts with --int= (go read that entry 📖). The SUM keyword shows the total number of interrupts received per second 🧮 The ALL keyword reports stats from every interrupt, and it's the default 🫧 Note that this needs sadc's -S INT option to have been used to collect the data 🔥
  • -i interval — selects data records at seconds as close as possible to the number you give for interval 🎯
  • --iface=iface_list — choose which network interfaces sar shows stats for 🌐 iface_list is a comma-separated list of interface names 🧵
  • --int=int_list — choose which interrupt names sar shows stats for 🎀 int_list is a comma-separated list of values or ranges, like 0-16,35,40- 🧁
  • -j { SID | ID | LABEL | PATH | UUID | ... } — displays persistent device names 💎 Use it together with -d 🤝 The keywords ID, LABEL, and so on tell it which type of persistent name you want. The list isn't limited to these, the only real requirement is that the directory holding the persistent names exists in /dev/disk 📂 The SID keyword tries to get a stable identifier to use as the device name 🪪 A stable identifier won't change across reboots for the same physical device. When one exists, it's usually the WWN (World Wide Name) of the device, read from the /dev/disk/by-id directory 🔍
  • -m { keyword[,...] | ALL } — report power management stats ⚡ Heads up: these need sadc's -S POWER option to have been used when collecting 🔌

Possible keywords are BAT, CPU, FAN, FREQ, IN, TEMP and USB 🌈

  • BAT — battery capacity stats get reported 🔋 The following values are displayed:
    • %cap — battery capacity 💪
    • cap/min — capacity the battery lost or gained per minute 📉📈
    • status — charging status of the battery: ↑ (full), ↗ (charging), → (not charging), ↘ (discharging), ? (unknown) 🕹️
  • CPU — CPU stats get reported 🧠 The following value is displayed:
    • MHz — instantaneous CPU clock frequency in MHz 🏎️
  • FAN — fan speed stats get reported 🌀 The following values are displayed:
    • rpm — fan speed in revolutions per minute 🔄
    • drpm — calculated as the difference between the current fan speed (rpm) and its low limit (fan_min) 📏
    • DEVICE — sensor device name 🏷️
  • FREQ — CPU clock frequency stats get reported 🎢 The following value is displayed:
    • wghMHz — weighted average CPU clock frequency in MHz 🧮 Also, the cpufreq-stats driver has to be compiled into the kernel for this to work, no cap 🧢
  • IN — voltage input stats get reported ⚡ The following values are displayed:
    • inV — voltage input in Volts 🔋
    • %in — relative input value. 100% means the voltage input has hit its high limit (in_max), and 0% means it hit its low limit (in_min) 🎚️
    • DEVICE — sensor device name 🏷️
  • TEMP — device temperature stats get reported 🌡️ The following values are displayed:
    • degC — device temperature in degrees Celsius 🥵
    • %temp — relative device temperature. 100% means it's reached its high limit (temp_max) 🔥
    • DEVICE — sensor device name 🏷️
  • USB — sar takes a snapshot of every USB device plugged into the system right now 🔌 At the end of the report, it shows a summary of all those USB devices 🧾 The following values are displayed:
    • BUS — root hub number of the USB device 🚌
    • idvendor — vendor ID number (assigned by the USB organization) 🏬
    • idprod — product ID number (assigned by the manufacturer) 🆔
    • maxpower — maximum power consumption of the device, in mA ⚡
    • manufact — manufacturer name 🏭
    • product — product name 🛍️

The ALL keyword is the same as listing every keyword above, so you get all the power management stats 👑

  • -n { keyword[,...] | ALL } — report network stats 🌐

Possible keywords are DEV, EDEV, FC, ICMP, EICMP, ICMP6, EICMP6, IP, EIP, IP6, EIP6, NFS, NFSD, SOCK, SOCK6, SOFT, TCP, ETCP, UDP and UDP6 🧩

  • DEV — stats from the network devices get reported 📡 You get every network interface unless you narrow it down with --iface= (see that entry 👀). The following values are displayed:
    • IFACE — name of the network interface being reported 🏷️
    • rxpck/s — total number of packets received per second 📥
    • txpck/s — total number of packets transmitted per second 📤
    • rxkB/s — total number of kibibytes received per second 💧
    • txkB/s — total number of kibibytes transmitted per second 🌊
    • rxcmp/s — number of compressed packets received per second (for cslip and friends) 🗜️
    • txcmp/s — number of compressed packets transmitted per second 🗜️
    • rxmcst/s — number of multicast packets received per second 📢
    • %ifutil — utilization percentage of the network interface. For half-duplex interfaces, it's calculated using the sum of rxkB/s and txkB/s as a percentage of the interface speed. For full-duplex, it's the greater of rxkB/S or txkB/s 🧮
  • EDEV — stats on failures (errors) from the network devices get reported 🚨 Again, you get every interface unless you narrow it with --iface= (see corresponding entry 👀). The following values are displayed:
    • IFACE — name of the network interface being reported 🏷️
    • rxerr/s — total number of bad packets received per second 🙅‍♀️
    • txerr/s — total number of errors that happened per second while transmitting packets 💥
    • coll/s — number of collisions that happened per second while transmitting packets 🚗💥🚗
    • rxdrop/s — number of received packets dropped per second because linux buffers ran out of space 🪣
    • txdrop/s — number of transmitted packets dropped per second because linux buffers ran out of space 🫗
    • txcarr/s — number of carrier-errors that happened per second while transmitting packets 📡💀
    • rxfram/s — number of frame alignment errors that happened per second on received packets 🧱
  • rxfifo/s — bestie, this one counts the FIFO overrun errors per second on received packets 📥💀
  • txfifo/s — same chaotic energy, but for transmitted packets 📤✨

💾 FC

With the FC keyword, we get the fibre channel traffic stats 🫶 Heads up: these depend on sadc's option -S DISK being collected, so make sure that's on. Here's what you get:

  • FCHOST — the name of the fibre channel host bus adapter (HBA) interface the stats are for 🧚
  • fch_rxf/s — the total number of frames received per second 📨
  • fch_txf/s — the total number of frames transmitted per second 📤
  • fch_rxw/s — the total number of transmission words received per second 💜
  • fch_txw/s — the total number of transmission words transmitted per second 🌸

🌐 ICMP

With the ICMP keyword, we're looking at ICMPv4 network traffic 🦋 Note that ICMPv4 stats depend on sadc's option -S SNMP being collected. The formal SNMP names are in square brackets, so you can match them up:

  • imsg/s — the total number of ICMP messages the entity received per second [icmpInMsgs]. This counter includes everything counted by ierr/s, so it's a big-picture one 👑
  • omsg/s — the total number of ICMP messages this entity tried to send per second [icmpOutMsgs]. This one also includes everything counted by oerr/s 💅
  • iech/s — ICMP Echo (request) messages received per second [icmpInEchos] 🏓
  • iechr/s — ICMP Echo Reply messages received per second [icmpInEchoReps] 🔁
  • oech/s — ICMP Echo (request) messages sent per second [icmpOutEchos] 🚀
  • oechr/s — ICMP Echo Reply messages sent per second [icmpOutEchoReps] 🎀
  • itm/s — ICMP Timestamp (request) messages received per second [icmpInTimestamps] ⏰
  • itmr/s — ICMP Timestamp Reply messages received per second [icmpInTimestampReps] ⏱️
  • otm/s — ICMP Timestamp (request) messages sent per second [icmpOutTimestamps] 🕰️
  • otmr/s — ICMP Timestamp Reply messages sent per second [icmpOutTimestampReps] 🧁
  • iadrmk/s — ICMP Address Mask Request messages received per second [icmpInAddrMasks] 🎭
  • iadrmkr/s — ICMP Address Mask Reply messages received per second [icmpInAddrMaskReps] 🎭
  • oadrmk/s — ICMP Address Mask Request messages sent per second [icmpOutAddrMasks] 🫧
  • oadrmkr/s — ICMP Address Mask Reply messages sent per second [icmpOutAddrMaskReps] 🫧

🚨 EICMP

With the EICMP keyword, we're getting into the ICMPv4 error messages 😭 Same deal: these depend on sadc's option -S SNMP. SNMP names are in square brackets again:

  • ierr/s — ICMP messages per second that the entity received but flagged as having ICMP-specific errors (bad ICMP checksums, bad length, etc.) [icmpInErrors] 🙈
  • oerr/s — ICMP messages per second that this entity didn't send because of problems found within ICMP, like a lack of buffers [icmpOutErrors] 🫠
  • idstunr/s — ICMP Destination Unreachable messages received per second [icmpInDestUnreachs] 🚧
  • odstunr/s — ICMP Destination Unreachable messages sent per second [icmpOutDestUnreachs] 🚧
  • itmex/s — ICMP Time Exceeded messages received per second [icmpInTimeExcds] ⌛
  • otmex/s — ICMP Time Exceeded messages sent per second [icmpOutTimeExcds] ⌛
  • iparmpb/s — ICMP Parameter Problem messages received per second [icmpInParmProbs] 🧩
  • oparmpb/s — ICMP Parameter Problem messages sent per second [icmpOutParmProbs] 🧩
  • isrcq/s — ICMP Source Quench messages received per second [icmpInSrcQuenchs] 🫥
  • osrcq/s — ICMP Source Quench messages sent per second [icmpOutSrcQuenchs] 🫥
  • iredir/s — ICMP Redirect messages received per second [icmpInRedirects] 🔀
  • oredir/s — ICMP Redirect messages sent per second [icmpOutRedirects] 🔀

🌙 ICMP6

With the ICMP6 keyword, it's ICMPv6 network traffic time 🌈 These depend on sadc's option -S IPV6 being collected. Formal SNMP names are in square brackets:

  • imsg6/s — the total number of ICMP messages the interface received per second, including everything counted by ierr6/s [ipv6IfIcmpInMsgs] 👑
  • omsg6/s — the total number of ICMP messages this interface tried to send per second [ipv6IfIcmpOutMsgs] 💅
  • iech6/s — ICMP Echo (request) messages the interface received per second [ipv6IfIcmpInEchos] 🏓
  • iechr6/s — ICMP Echo Reply messages the interface received per second [ipv6IfIcmpInEchoReplies] 🔁
  • oechr6/s — ICMP Echo Reply messages the interface sent per second [ipv6IfIcmpOutEchoReplies] 🎀
  • igmbq6/s — ICMPv6 Group Membership Query messages the interface received per second [ipv6IfIcmpInGroupMembQueries] 🫧
  • igmbr6/s — ICMPv6 Group Membership Response messages the interface received per second [ipv6IfIcmpInGroupMembResponses] 🫧
  • ogmbr6/s — ICMPv6 Group Membership Response messages sent per second [ipv6IfIcmpOutGroupMembResponses] 🫧
  • igmbrd6/s — ICMPv6 Group Membership Reduction messages the interface received per second [ipv6IfIcmpInGroupMembReductions] 🪄
  • ogmbrd6/s — ICMPv6 Group Membership Reduction messages sent per second [ipv6IfIcmpOutGroupMembReductions] 🪄
  • irtsol6/s — ICMP Router Solicit messages the interface received per second [ipv6IfIcmpInRouterSolicits] 🧭
  • ortsol6/s — ICMP Router Solicitation messages the interface sent per second [ipv6IfIcmpOutRouterSolicits] 🧭
  • irtad6/s — ICMP Router Advertisement messages the interface received per second [ipv6IfIcmpInRouterAdvertisements] 📣
  • inbsol6/s — ICMP Neighbor Solicit messages the interface received per second [ipv6IfIcmpInNeighborSolicits] 🏘️
  • onbsol6/s — ICMP Neighbor Solicitation messages the interface sent per second [ipv6IfIcmpOutNeighborSolicits] 🏘️
  • inbad6/s — ICMP Neighbor Advertisement messages the interface received per second [ipv6IfIcmpInNeighborAdvertisements] 🏠
  • onbad6/s — ICMP Neighbor Advertisement messages the interface sent per second [ipv6IfIcmpOutNeighborAdvertisements] 🏠

💥 EICMP6

With the EICMP6 keyword, we're checking the ICMPv6 error messages 🥲 These depend on sadc's option -S IPV6. Formal SNMP names are in square brackets:

  • ierr6/s — ICMP messages per second that the interface received but flagged as having ICMP-specific errors (bad ICMP checksums, bad length, etc.) [ipv6IfIcmpInErrors] 🙈
  • idtunr6/s — ICMP Destination Unreachable messages the interface received per second [ipv6IfIcmpInDestUnreachs] 🚧
  • odtunr6/s — ICMP Destination Unreachable messages the interface sent per second [ipv6IfIcmpOutDestUnreachs] 🚧
  • itmex6/s — ICMP Time Exceeded messages the interface received per second [ipv6IfIcmpInTimeExcds] ⌛
  • otmex6/s — ICMP Time Exceeded messages the interface sent per second [ipv6IfIcmpOutTimeExcds] ⌛
  • iprmpb6/s — ICMP Parameter Problem messages the interface received per second [ipv6IfIcmpInParmProblems] 🧩
  • oprmpb6/s — ICMP Parameter Problem messages the interface sent per second [ipv6IfIcmpOutParmProblems] 🧩
  • iredir6/s — Redirect messages the interface received per second [ipv6IfIcmpInRedirects] 🔀
  • oredir6/s — Redirect messages the interface sent by second [ipv6IfIcmpOutRedirects] 🔀
  • ipck2b6/s — ICMP Packet Too Big messages the interface received per second [ipv6IfIcmpInPktTooBigs] 📦
  • opck2b6/s — ICMP Packet Too Big messages the interface sent per second [ipv6IfIcmpOutPktTooBigs] 📦

🌍 IP

With the IP keyword, we're getting the IPv4 network traffic stats 💖 Note that IPv4 stats depend on sadc's option -S SNMP being collected. Formal SNMP names are in square brackets, so keep an eye out for them:

  • irec/s — Okay so this is the total number of input datagrams that came in from interfaces per second, and yes, that includes the ones that arrived broken 💀 [ipInReceives].
  • fwddgm/s — Datagrams per second that weren't meant for this entity at all, so it went hunting for a route to pass them along to their real final destination 🦋 [ipForwDatagrams].
  • idel/s — The total number of input datagrams successfully delivered per second up to the IP user-protocols, ICMP included 💌 [ipInDelivers].
  • orq/s — The total number of IP datagrams that local IP user-protocols (ICMP included) handed to IP per second as transmission requests 📮 [ipOutRequests]. Heads up, this counter doesn't include anything already counted in fwddgm/s 👀.
  • asmrq/s — The number of IP fragments received per second that had to be reassembled here 🧩 [ipReasmReqds].
  • asmok/s — The number of IP datagrams successfully reassembled per second ✨ [ipReasmOKs].
  • fragok/s — The number of IP datagrams successfully fragmented at this entity per second 🍰 [ipFragOKs].
  • fragcrt/s — The number of IP datagram fragments generated per second because of fragmentation at this entity 🫶 [ipFragCreates].

With the EIP keyword, you get the IPv4 network error stats. Real talk, IPv4 stats need sadc's option -S SNMP to be collected, or they won't show up 🙈. These are the values displayed (formal SNMP names in square brackets):

  • ihdrerr/s — The number of input datagrams discarded per second because of errors in their IP headers. That covers bad checksums, version number mismatches, other format errors, time-to-live exceeded, errors found while processing their IP options, and so on 💀 [ipInHdrErrors].
  • iadrerr/s — The number of input datagrams discarded per second because the IP address in their header's destination field wasn't valid to receive at this entity. This includes invalid addresses (like 0.0.0.0) and addresses from unsupported Classes (like Class E). For entities that aren't IP routers, and therefore don't forward datagrams, it also counts datagrams dropped because the destination wasn't a local address 🚫 [ipInAddrErrors].
  • iukwnpr/s — The number of locally-addressed datagrams received successfully but discarded per second because the protocol was unknown or unsupported 🤷‍♀️ [ipInUnknownProtos].
  • idisc/s — The number of input IP datagrams per second that had no problems stopping them from being processed, but got discarded anyway (for example, for lack of buffer space) 🗑️ [ipInDiscards]. This counter doesn't include datagrams discarded while waiting for reassembly.
  • odisc/s — The number of output IP datagrams per second that had no problem stopping them from reaching their destination, but got discarded anyway (for example, for lack of buffer space) 📤 [ipOutDiscards]. Note that this counter would include datagrams counted in fwddgm/s if any of them met this (discretionary) discard criterion.
  • onort/s — The number of IP datagrams discarded per second because no route could be found to get them to their destination 🧭 [ipOutNoRoutes]. This counter includes any packets counted in fwddgm/s that meet this 'no-route' criterion. It also includes any datagrams a host can't route because all of its default routers are down.
  • asmf/s — The number of failures per second detected by the IP reassembly algorithm, for whatever reason (timed out, errors, etc.) 💔 [ipReasmFails]. This isn't necessarily a count of discarded IP fragments, because some algorithms can lose track of how many fragments there are when they combine them as they arrive.
  • fragf/s — The number of IP datagrams discarded per second because they needed to be fragmented at this entity but couldn't be, for example because their Don't Fragment flag was set 🚧 [ipFragFails].

With the IP6 keyword, you get the IPv6 network traffic stats. Same deal as before: IPv6 stats need sadc's option -S IPV6 to be collected 💅. These are the values displayed (formal SNMP names in square brackets):

  • irec6/s — The total number of input datagrams received from interfaces per second, including the ones received in error [ipv6IfStatsInReceives].
  • fwddgm6/s — The number of output datagrams per second that this entity received and forwarded on to their final destinations 🦋 [ipv6IfStatsOutForwDatagrams].
  • idel6/s — The total number of datagrams successfully delivered per second to the IPv6 user-protocols, ICMP included 💌 [ipv6IfStatsInDelivers].
  • orq6/s — The total number of IPv6 datagrams that local IPv6 user-protocols (ICMP included) supplied per second to IPv6 as transmission requests 📮 [ipv6IfStatsOutRequests]. This counter doesn't include any datagrams counted in fwddgm6/s.
  • asmrq6/s — The number of IPv6 fragments received per second that needed to be reassembled at this interface 🧩 [ipv6IfStatsReasmReqds].
  • asmok6/s — The number of IPv6 datagrams successfully reassembled per second ✨ [ipv6IfStatsReasmOKs].
  • imcpck6/s — The number of multicast packets received per second by the interface 📡 [ipv6IfStatsInMcastPkts].
  • omcpck6/s — The number of multicast packets transmitted per second by the interface 📣 [ipv6IfStatsOutMcastPkts].
  • fragok6/s — The number of IPv6 datagrams successfully fragmented at this output interface per second 🍰 [ipv6IfStatsOutFragOKs].
  • fragcr6/s — The number of output datagram fragments generated per second because of fragmentation at this output interface 🫶 [ipv6IfStatsOutFragCreates].

With the EIP6 keyword, you get the IPv6 network error stats. Once again, these depend on sadc's option -S IPV6 being collected 🌸. These are the values displayed (formal SNMP names in square brackets):

  • ihdrer6/s — The number of input datagrams discarded per second because of errors in their IPv6 headers. That includes version number mismatches, other format errors, hop count exceeded, errors found while processing their IPv6 options, and so on 💀 [ipv6IfStatsInHdrErrors]
  • iadrer6/s — The number of input datagrams discarded per second because the IPv6 address in their header's destination field wasn't valid to receive at this entity. This includes invalid addresses (like ::0) and unsupported addresses (like addresses with unallocated prefixes). For entities that aren't IPv6 routers, and therefore don't forward datagrams, it also counts datagrams dropped because the destination wasn't a local address 🚫 [ipv6IfStatsInAddrErrors].
  • iukwnp6/s — The number of locally-addressed datagrams received successfully but discarded per second because the protocol was unknown or unsupported 🤷‍♀️ [ipv6IfStatsInUnknownProtos].
  • i2big6/s — The number of input datagrams per second that couldn't be forwarded because their size was bigger than the link MTU of the outgoing interface 📏 [ipv6IfStatsInTooBigErrors].
  • idisc6/s — The number of input IPv6 datagrams per second that had no problems stopping them from being processed, but got discarded anyway (for example, for lack of buffer space) 🗑️ [ipv6IfStatsInDiscards]. This counter doesn't include datagrams discarded while waiting for reassembly.
  • odisc6/s — The number of output IPv6 datagrams per second that had no problem stopping them from reaching their destination, but got discarded anyway (for example, for lack of buffer space) 📤 [ipv6IfStatsOutDiscards]. This counter would include datagrams counted in fwddgm6/s if any of them met this (discretionary) discard criterion.
  • inort6/s — The number of input datagrams discarded per second because no route could be found to get them to their destination 🧭 [ipv6IfStatsInNoRoutes].
  • onort6/s — The number of locally generated IP datagrams discarded per second because no route could be found to get them to their destination 🧭 [unknown formal SNMP name].
  • asmf6/s — The number of failures per second detected by the IPv6 reassembly algorithm, for whatever reason (timed out, errors, etc.) 💔 [ipv6IfStatsReasmFails]. This isn't necessarily a count of discarded IPv6 fragments, because some algorithms can lose track of how many fragments there are when they combine them as they arrive.
  • fragf6/s — okay so this one counts the IPv6 datagrams that got tossed each second because they needed fragmenting at this output interface but couldn't be 💀 [ipv6IfStatsOutFragFails].
  • itrpck6/s — the input datagrams dropped each second because the datagram frame didn't carry enough data to be valid 🙈 [ipv6IfStatsInTruncatedPkts].

With the NFS keyword, we get the receipts on NFS client activity 🧾 The following values are displayed:

  • call/s — how many RPC requests the client made per second 📞
  • retrans/s — how many of those RPC requests per second had to be sent again, like when the server timed out 😤
  • read/s — how many 'read' RPC calls were made per second 📖
  • write/s — how many 'write' RPC calls were made per second ✍️
  • access/s — how many 'access' RPC calls were made per second 🔑
  • getatt/s — how many 'getattr' RPC calls were made per second 👀

With the NFSD keyword, we get the tea on NFS server activity ☕ The following values are displayed:

  • scall/s — how many RPC requests the server received per second 📥
  • badcall/s — how many bad RPC requests came in per second, the ones whose processing ended up throwing an error 💀
  • packet/s — how many network packets were received per second 📦
  • udp/s — how many UDP packets were received per second 🦋
  • tcp/s — how many TCP packets were received per second 🧵
  • hit/s — how many reply cache hits happened per second 🎯
  • miss/s — how many reply cache misses happened per second 🙃
  • sread/s — how many 'read' RPC calls were received per second 📖
  • swrite/s — how many 'write' RPC calls were received per second ✍️
  • saccess/s — how many 'access' RPC calls were received per second 🔑
  • sgetatt/s — how many 'getattr' RPC calls were received per second 👀

With the SOCK keyword, we check the socket situation that's in use (IPv4) 🧦 The following values are displayed:

  • totsck — the total number of sockets the system is using, full stop 🌸
  • tcpsck — how many TCP sockets are in use right now 🧵
  • udpsck — how many UDP sockets are in use right now 🦋
  • rawsck — how many RAW sockets are in use right now 🥩
  • ip-frag — how many IP fragments are sitting in the queue right now 🧩
  • tcp-tw — how many TCP sockets are in the TIME_WAIT state ⏳

With the SOCK6 keyword, we check the socket situation in use (IPv6) 🌐 Heads up, IPv6 stats only show up if you collect them with sadc's option -S IPV6 ⚠️ The following values are displayed:

  • tcp6sck — how many TCPv6 sockets are in use right now 🧵
  • udp6sck — how many UDPv6 sockets are in use right now 🦋
  • raw6sck — how many RAWv6 sockets are in use right now 🥩
  • ip6-frag — how many IPv6 fragments are currently in use 🧩

With the SOFT keyword, we peek at the software-based network processing 🧠 The following values are displayed:

  • total/s — the total number of network frames processed per second 📊
  • dropd/s — the total number of network frames dropped per second because the processing queue had no room left 🗑️
  • squeezd/s — how many times per second the softirq handler function stopped because its budget ran out or it hit the time limit, even though there was still more work it could've done 😩
  • rx_rps/s — how many times per second the CPU got woken up to process packets via an inter-processor interrupt ⏰
  • flw_lim/s — how many times per second the flow limit got reached 🚧 Flow limiting is an optional RPS feature that caps how many packets can be queued to the backlog for each flow, to a certain amount. It's giving fairness, because it helps make sure the smaller flows still get processed even when the much bigger flows are pushing packets in like crazy 🫶
  • blg_len — the length of the network backlog 📚

With the TCP keyword, we get the tea on TCPv4 network traffic 🍵 Note that TCPv4 stats depend on sadc's option -S SNMP being collected ⚠️ The following values are displayed (formal SNMP names are in square brackets):

  • active/s — how many times per second TCP connections went straight from CLOSED to SYN-SENT [tcpActiveOpens] 🚀
  • passive/s — how many times per second TCP connections went straight from LISTEN to SYN-RCVD [tcpPassiveOpens] 👂
  • iseg/s — the total number of segments received per second, errors included [tcpInSegs] 📥 This count includes segments received on connections that are currently established 🤝
  • oseg/s — the total number of segments sent per second [tcpOutSegs] 📤 This includes the ones on current connections but leaves out the ones that only contained retransmitted octets 🙅

With the ETCP keyword, we check the TCPv4 network errors 🚨 Note that TCPv4 stats depend on sadc's option -S SNMP being collected ⚠️ The following values are displayed (formal SNMP names are in square brackets):

  • atmptf/s — how many times per second TCP connections went to CLOSED from SYN-SENT or SYN-RCVD, plus how many times per second they went to LISTEN from SYN-RCVD [tcpAttemptFails] 💔
  • estres/s — how many times per second TCP connections went to CLOSED from ESTABLISHED or CLOSE-WAIT [tcpEstabResets] 🫠
  • retrseg/s — the total number of segments retransmitted per second, meaning TCP segments sent that contained one or more previously transmitted octets [tcpRetransSegs] 🔁
  • isegerr/s — the total number of segments received in error per second, like bad TCP checksums [tcpInErrs] 🙅‍♀️
  • orsts/s — how many TCP segments per second were sent with the RST flag set [tcpOutRsts] 🛑

With the UDP keyword, we look at UDPv4 network traffic 🦋 Note that UDPv4 stats depend on sadc's option -S SNMP being collected ⚠️ The following values are displayed (formal SNMP names are in square brackets):

  • idgm/s — the total number of UDP datagrams delivered per second to UDP users [udpInDatagrams] 📬
  • odgm/s — the total number of UDP datagrams sent per second from this entity [udpOutDatagrams] 📤
  • noport/s — the total number of received UDP datagrams per second that had no application at the destination port [udpNoPorts] 🏚️
  • idgmerr/s — the number of received UDP datagrams per second that couldn't be delivered for reasons other than having no application at the destination port [udpInErrors] 😵

With the UDP6 keyword, we look at UDPv6 network traffic 🌐 Note that UDPv6 stats depend on sadc's option -S IPV6 being collected ⚠️ The following values are displayed (formal SNMP names are in square brackets):

  • idgm6/s — the total number of UDP datagrams delivered per second to UDP users [udpInDatagrams] 📬
  • odgm6/s — the total number of UDP datagrams sent per second from this entity [udpOutDatagrams] 📤
  • noport6/s — the total number of received UDP datagrams per second that had no application at the destination port [udpNoPorts] 🏚️
  • idgmer6/s — the number of received UDP datagrams per second that couldn't be delivered for reasons other than having no application at the destination port [udpInErrors] 😵

The ALL keyword is basically the whole main character lineup 👑 It's the same as typing every keyword above, so all the network activities get reported 🌈

  • -o [ *filename* ] — okay this one saves your readings to a file in binary form 💾 Each reading gets its own separate record. The default filename is the current standard system activity daily data file 📁 If filename is a directory instead of a plain file, then it's treated as the directory where the standard system activity daily data files live 🗂️ Heads up, -o can't be used together with -f 🙅 All the data available from the kernel gets saved to the file, because sar calls its data collector sadc with the option -S ALL 🧠 (See the sadc(8) manual page for more.)
  • -P { *cpu_list* | ALL } — reports per-processor stats for the processor or processors you pick 🖥️ cpu_list is a list of comma-separated values or a range of values, like 0,2,4-7,12- 🎀 Processor 0 is the first processor, and processor all is the global average across all processors ✨ Using the ALL keyword reports stats for each individual processor, plus the global stats for all processors together 💅 Offline processors don't get displayed 🙈
  • -p, --pretty — makes reports easier for humans to read 🧁 This one is especially useful when you're looking at network interface or block device stats 💖
  • -q [ *keyword*[,...] | ALL ] — reports system load and pressure-stall stats 📈

Possible keywords are CPU, IO, LOAD, MEM and PSI 🌸

With the CPU keyword, we get the CPU pressure stats 😤 The following values are displayed:

  • %scpu-10 — the percentage of time that at least some runnable tasks were delayed because the CPU wasn't available to them, measured over the last 10 second window ⏱️

Okay so the pressure stats are where it gets spicy 🌶️ Each % field tells you how often tasks were stuck, and the number at the end is the time window.

  • %scpu-60 — 🔥 Percentage of the time that at least some runnable tasks were delayed because the CPU was unavailable to them, over the last 60 second window.
  • %scpu-300 — 🔥 Same vibe, but over the last 300 second window.
  • %scpu — 🔥 Same vibe again, but over the last time interval.

With the IO keyword, you get I/O pressure stats 💾 Here's what shows up:

  • %sio-10 — Percentage of the time that at least some tasks lost waiting for I/O, over the last 10 second window.
  • %sio-60 — Percentage of the time that at least some tasks lost waiting for I/O, over the last 60 second window.
  • %sio-300 — Percentage of the time that at least some tasks lost waiting for I/O, over the last 300 second window.
  • %sio — Percentage of the time that at least some tasks lost waiting for I/O, over the last time interval.
  • %fio-10 — Percentage of the time during which all non-idle tasks were stalled waiting for I/O, over the last 10 second window. 💀
  • %fio-60 — Percentage of the time during which all non-idle tasks were stalled waiting for I/O, over the last 60 second window. 💀
  • %fio-300 — Percentage of the time during which all non-idle tasks were stalled waiting for I/O, over the last 300 second window. 💀
  • %fio — Percentage of the time during which all non-idle tasks were stalled waiting for I/O, over the last time interval. 💀

With the LOAD keyword, you get queue length and load averages 📈 These are the values:

  • runq-sz — Run queue length (number of tasks running or waiting for run time).
  • plist-sz — Number of tasks in the task list.
  • ldavg-1 — System load average for the last minute. The load average is calculated as the average number of runnable or running tasks (R state), and the number of tasks in uninterruptible sleep (D state) over the specified interval.
  • ldavg-5 — System load average for the past 5 minutes.
  • ldavg-15 — System load average for the past 15 minutes.
  • blocked — Number of tasks currently blocked, waiting for I/O to complete.

With the MEM keyword, you get memory pressure stats 🧠 Here's the lineup:

  • %smem-10 — Percentage of the time during which at least some tasks were waiting for memory resources, over the last 10 second window.
  • %smem-60 — Percentage of the time during which at least some tasks were waiting for memory resources, over the last 60 second window.
  • %smem-300 — Percentage of the time during which at least some tasks were waiting for memory resources, over the last 300 second window.
  • %smem — Percentage of the time during which at least some tasks were waiting for memory resources, over the last time interval.
  • %fmem-10 — Percentage of the time during which all non-idle tasks were stalled waiting for memory resources, over the last 10 second window. 💀
  • %fmem-60 — Percentage of the time during which all non-idle tasks were stalled waiting for memory resources, over the last 60 second window. 💀
  • %fmem-300 — Percentage of the time during which all non-idle tasks were stalled waiting for memory resources, over the last 300 second window. 💀
  • %fmem — Percentage of the time during which all non-idle tasks were stalled waiting for memory resources, over the last time interval. 💀

The PSI keyword is basically CPU, IO and MEM all bundled together 🎀 so you get every pressure-stall stat at once.

The ALL keyword is the whole buffet 🍓 It's the same as naming every keyword above, so every single stat gets reported.

  • -r [ ALL ] — 🧠 Reports memory utilization stats. The ALL keyword means every memory field gets displayed. These are the values that may show up:
    • kbmemfree — Amount of free memory available in kibibytes.
    • kbavail — Estimate of how much memory in kibibytes is available for starting new applications, without swapping. The estimate takes into account that the system needs some page cache to function well, and that not all reclaimable slab will be reclaimable, due to items being in use. The impact of those factors will vary from system to system.
    • kbmemused — Amount of used memory in kibibytes (calculated as total installed memory - kbmemfree - kbbuffers - kbcached - kbslab).
    • %memused — Percentage of used memory.
    • kbbuffers — Amount of memory used as buffers by the kernel in kibibytes.
    • kbcached — Amount of memory used to cache data by the kernel in kibibytes.
    • kbcommit — Amount of memory in kibibytes needed for current workload. This is an estimate of how much RAM/swap is needed to guarantee that there never is out of memory.
    • %commit — Percentage of memory needed for current workload in relation to the total amount of memory (RAM+swap). This number may be greater than 100% because the kernel usually overcommits memory.
    • kbactive — Amount of active memory in kibibytes (memory that has been used more recently and usually not reclaimed unless absolutely necessary).
    • kbinact — Amount of inactive memory in kibibytes (memory which has been less recently used. It is more eligible to be reclaimed for other purposes).
    • kbdirty — Amount of memory in kibibytes waiting to get written back to the disk.
    • kbanonpg — Amount of non-file backed pages in kibibytes mapped into userspace page tables.
    • kbslab — Amount of memory in kibibytes used by the kernel to cache data structures for its own use.
    • kbkstack — Amount of memory in kibibytes used for kernel stack space.
    • kbpgtbl — Amount of memory in kibibytes dedicated to the lowest level of page tables.
    • kbvmused — Amount of memory in kibibytes of used virtual address space.
  • -S — 🔄 Reports swap space utilization stats. These are the values displayed:
    • kbswpfree — Amount of free swap space in kibibytes.
    • kbswpused — Amount of used swap space in kibibytes.
    • %swpused — Percentage of used swap space.
    • kbswpcad — Amount of cached swap memory in kibibytes. This is memory that once was swapped out, is swapped back in but still also is in the swap area (if memory is needed it doesn't need to be swapped out again because it is already in the swap area. This saves I/O).
    • %swpcad — Percentage of cached swap memory in relation to the amount of used swap space.
  • -s [ hh:mm[:ss] ] and -s [ seconds_since_the_epoch ] — ⏰ Sets the starting time of the data, so sar pulls records time-tagged at, or following, the time you give it. The default starting time is 08:00:00. Hours have to be in 24-hour format, or you can give the number of seconds since the epoch (a 10 digit number). This option only works when data is read from a file (option -f).
  • --sadc — 🔍 Tells you which data collector sar calls. If the data collector is hiding somewhere in PATH, type "which sadc" to find out where it lives.
  • -t — 🌍 When reading data from a daily data file, this makes sar show timestamps in the original local time of the data file creator. Without it, sar shows timestamps in your own local time.
  • -u [ ALL ] — 💻 Reports CPU utilization. The ALL keyword means every CPU field gets displayed. The report may show these fields:
    • %user — Percentage of CPU utilization that occurred while executing at the user level (application). Note that this field includes time spent running virtual processors.
    • %usr — Percentage of CPU utilization that occurred while executing at the user level (application). Note that this field does NOT include time spent running virtual processors.
    • %nice — Percentage of CPU utilization that occurred while executing at the user level with nice priority.
    • %system — Percentage of CPU utilization that occurred while executing at the system level (kernel). Note that this field includes time spent servicing hardware and software interrupts.
    • %sys — Percentage of CPU utilization that occurred while executing at the system level (kernel). Note that this field does NOT include time spent servicing hardware or software interrupts.
    • %iowait — Percentage of time that the CPU or CPUs were idle during which the system had an outstanding disk I/O request. 🫶

%steal 🫣 Percentage of time the virtual CPU or CPUs spent in involuntary wait while the hypervisor was busy servicing another virtual processor. Basically, someone else's VM was hogging the host.

  • %irq ⚡ Percentage of time the CPU or CPUs spent handling hardware interrupts.
  • %soft 🌀 Percentage of time the CPU or CPUs spent handling software interrupts.
  • %guest 🫶 Percentage of time the CPU or CPUs spent running a virtual processor.
  • %gnice 😇 Percentage of time the CPU or CPUs spent running a niced guest.
  • %idle 😴 Percentage of time the CPU or CPUs were just chilling, idle, and the system had no outstanding disk I/O request waiting on it.
  • -V 🏷️ Prints the version number and then bounces.
  • -v 🗂️ Reports the status of the inode, file, and other kernel tables. You'll see these values:
    • dentunusd 🧹 Number of unused cache entries in the directory cache.
    • file-nr 📁 Number of file handles the system is using.
    • inode-nr 🔢 Number of inode handlers the system is using.
    • pty-nr 🖥️ Number of pseudo-terminals the system is using.
  • -W 🔄 Reports swapping stats. You'll get these values:
    • pswpin/s 📥 Total number of swap pages the system brought in per second.
    • pswpout/s 📤 Total number of swap pages the system brought out per second.
  • -w 🧵 Reports task creation and system switching activity. You'll get these values:
    • proc/s 🌱 Total number of tasks created per second.
    • cswch/s 🔀 Total number of context switches per second.
  • -x 📈 Extended reports! On top of the averages, you also get the minimum and maximum values at the end of the report.
  • -y 📟 Reports TTY device activity. You'll get these values:
    • rcvin/s 📨 Number of receive interrupts per second for the current serial line. The serial line number shows up in the TTY column.
    • xmtin/s 📤 Number of transmit interrupts per second for the current serial line.
    • framerr/s 💥 Number of frame errors per second for the current serial line.
    • prtyerr/s ⚠️ Number of parity errors per second for the current serial line.
    • brk/s 💔 Number of breaks per second for the current serial line.
    • ovrun/s 🌊 Number of overrun errors per second for the current serial line.
  • -z 🫧 Tells sar to skip the output for any devices that had zero activity during the sample period. Tidy!

🌍 ENVIRONMENT 🌍

The sar command is super aware of the following environment variables. 👀

  • S_COLORS 🎨 By default, stats show up in color when the output goes to a terminal. Use this variable to change that. The possible values are never, always, or auto (and auto is the same as the default). Also, no cap, the color a value shows up in (red, yellow, or whatever) doesn't mean something is wrong. The colors just mark different ranges of values. 🙅‍♀️
  • S_COLORS_SGR 🌈 Lets you pick the colors and other attributes used to display stats on the terminal. The value is a colon-separated list of capabilities. It defaults to C=33;22:I=32;22:N=34;1:R=31;22:W=35;1:X=31;1:Z=34;22. The supported capabilities are:
    • C= 💬 SGR (Select Graphic Rendition) substring for comments inserted in the binary daily data files.
    • I= 🏷️ SGR substring for item names or values (like network interfaces, the CPU number, and so on).
    • N= 🔥 SGR substring for non-zero statistics values.
    • R= 🔁 SGR substring for restart messages.
    • W= (or M=) ⚠️ SGR substring for percentage values in the range from 75% to 90% (or from 10% to 25%, depending on what the metric means). It's also used for negative values in the range from -10 to -5.
    • X= (or H=) 🚨 SGR substring for percentage values greater than or equal to 90% (or less than or equal to 10%, depending on what the metric means). It's also used for negative values less than or equal to -10.
    • Z= 🫥 SGR substring for zero values.
  • S_REPEAT_HEADER 📋 This contains the maximum number of lines after which sar has to show a header again when the output is not a terminal.
  • S_TIME_DEF_TIME 🕰️ If this variable exists and its value is UTC, then sar saves its data in UTC time (the data still displays in local time). sar also uses UTC instead of local time to figure out which daily data file in the /var/log/sysstat directory is the current one. This can be handy for servers with users spread across several timezones. 🌏
  • S_TIME_FORMAT 📅 If this variable exists and its value is ISO, then the current locale gets ignored when printing the date in the report header. sar uses the ISO 8601 format (YYYY-MM-DD) instead. The timestamps follow ISO 8601 too. Very organized of it. 💅

🧪 EXAMPLES 🧪

sar -u 2 5

Reports CPU utilization every 2 seconds. 5 lines are displayed. ⏱️

sar -I --int=14 -o int14.file 2 10

Reports stats on IRQ 14 every 2 seconds. 10 lines are displayed. The data gets saved in a file called int14.file. 💾

sar -r -n DEV -f /var/log/sysstat/sa16

Displays the memory and network stats saved in the daily data file sa16. 🧠🌐

sar -A

Displays all the stats saved in the current daily data file. Everything, all at once! 🫠

🐛 BUGS 🐛

🚨 The /proc filesystem must be mounted for sar to work. No /proc, no sar. Period. 🙅‍♀️

Not every statistic is necessarily available. It depends on the kernel version you're using. sar assumes you're running at least a 2.6 kernel. 🧐

🤓 Here's a fun little gotcha: even though sar shows units that look like kilobytes (kB), megabytes (MB)..., it actually uses kibibytes (kiB), mebibytes (MiB)... A kibibyte is 1024 bytes, and a mebibyte is 1024 kibibytes. Math is serving. 🧮

📁 FILES 📁

  • /var/log/sysstat/saDD 🗓️
  • /var/log/sysstat/saYYYYMMDD 🗓️ These are the standard system activity daily data files, plus their default location. YYYY stands for the current year, MM for the current month, and DD for the current day. ✨
  • /proc and /sys 🧾 These contain various files with system statistics. The good stuff lives here! 🔍

👩‍💻 AUTHOR 👩‍💻

Sebastien Godard (sysstat <at> orange.fr) 🫶

🔗 SEE ALSO 🔗

sadc(8), sa1(8), sa2(8), sadf(1), sysstat(5), pidstat(1), mpstat(1), iostat(1), vmstat(8) 💖

https://github.com/sysstat/sysstat 🐙 https://sysstat.github.io/ 🌸

Bestie, that's the whole sar page! 🌈💅 You now know everything about system activity reporting, and honestly? Iconic. Stay curious, stay caffeinated, and go watch your CPU chill for a sec. 🦋✨

📦 where this page comes from