SAR(1)

📦
version 12.8.0 · 9 versions
, in arch rolling

💖 sar(1) 💖

okay so this one's from the Linux User's Manual, section 1, and it's sar. it's a whole thing, bestie — grab a snack 🍓

✨ NAME ✨

sar — collect, report, or save system activity information. that's the whole job. it's giving "the main character of system monitoring" 👑

✨ SYNOPSIS ✨

sar [ -A ] [ -B ] [ -b ] [ -C ] [ -D ] [ -d ] [ -F [ MOUNT ] ] [ -H ] [
-h ] [ -p ] [ -r [ ALL ] ] [ -S ] [ -t ] [ -u [ ALL ] ] [ -V ] [ -v ] [
-W ] [ -w ] [ -x ] [ -y ] [ -z ] [ --dec={ 0 | 1 | 2 } ] [
--dev=dev_list ] [ --fs=fs_list ] [ --help ] [ --human ] [
--iface=iface_list ] [ --int=int_list ] [ --pretty ] [ --sadc ] [ -I [
SUM | ALL ] ] [ -P { cpu_list | ALL } ] [ -m { keyword[,...] | ALL } ] [
-n { keyword[,...] | ALL } ] [ -q [ keyword[,...] | ALL ] ] [ -j { SID |
ID | LABEL | PATH | UUID | ... } ] [ -f [ filename ] | -o [ filename ] |
-[0-9]+ ] [ -i interval ] [ -s [ start_time ] ] [ -e [ end_time ] ] ] [
interval [ count ] ]

yeah she's long. she's worth it tho 🫶

🦋 DESCRIPTION 🦋

so the sar command writes to standard output the contents of selected cumulative activity counters in the operating system. basically it peeks at the kernel's receipts 💅

the accounting system, based on the values in the count and interval parameters, writes information the specified number of times spaced at the specified intervals in seconds. so like — you say how often, you say how many, it goes brrr.

if the interval parameter is set to zero, the sar command displays the average statistics for the time since the system was started. origin story energy ✨ and if interval is specified without count, then reports are generated continuously — no cap, it just keeps going 😭

the collected data can also be saved in the file specified by the -o filename flag, in addition to being displayed onto the screen. and if filename is omitted, sar uses the standard system activity daily data file (details below, iykyk). by default all the data available from the kernel are saved in the data file. all of it. no crumbs.

the sar command also extracts and writes to standard output records previously saved in a file. this file can be either the one specified by the -f flag or, by default, the standard system activity daily data file. and here's the cute part — it is also possible to enter -1, -2 etc. as an argument to sar to display data of that many days ago. for example, -1 will point at the standard system activity file of yesterday 🕰️ time travel but make it sysadmin.

standard system activity daily data files are named saDD or saYYYYMMDD, where YYYY stands for the current year, MM for the current month and DD for the current day. they are the default files used by sar only when no filename has been explicitly specified. when used to write data to files (with its option -o), sar will use saYYYYMMDD if option -D has also been specified, else it will use saDD. when used to display the records previously saved in a file, sar will look for the most recent of saDD and saYYYYMMDD, and use it. queen of always picking the freshest fit 👗

standard system activity daily data files are located in the /var/log/sa directory by default. yet it is possible to specify an alternate location for them: if a directory (instead of a plain file) is used with options -f or -o then it will be considered as the directory containing the data files. flexible. we love to see it 💫

without the -P flag, the sar command reports system-wide (global among all processors) statistics, which are calculated as averages for values expressed as percentages, and as sums otherwise. if the -P flag is given, the sar command reports activity which relates to the specified processor or processors. if -P ALL is given, the sar command reports statistics for each individual processor and global statistics among all processors. offline processors are not displayed — if they're not on the apps, they're not in the report 🙈

you can select information about specific system activities using flags. not specifying any flags selects only CPU activity. specifying the -A flag selects all possible activities. go big or go home honestly 🔥

the default version of the sar command (CPU utilization report) might be one of the first facilities the user runs to begin system activity investigation, because it monitors major system resources. if CPU utilization is near 100 percent (user + nice + system), the workload sampled is CPU-bound. she's booked, she's busy, she's at capacity 💀

if multiple samples and multiple reports are desired, it is convenient to specify an output file for the sar command. run the sar command as a background process. the syntax for this is:

sar -o datafile interval count >/dev/null 2>&1 &

all data are captured in binary form and saved to a file (datafile). the data can then be selectively displayed with the sar command using the -f option. set the interval and count parameters to select count records at interval second intervals. if the count parameter is not set, all the records saved in the file will be selected. collection of data in this manner is useful to characterize system usage over a period of time and determine peak usage hours. it's giving "let me take notes so I can gossip about my system later" 📝

Note: the sar command only reports on local activities. no long-distance, bestie. this is local-only 🏠

🌈 OPTIONS 🌈

  • -A — this is equivalent to specifying -bBdFHISvwWy -m ALL -n ALL -q ALL -r ALL -u ALL. this option also implies specifying -I ALL -P ALL unless these options are explicitly set on the command line. basically the "give me everything" button 🍽️
  • -B — report paging statistics. the following values are displayed:
    • pgpgin/s — total number of kibibytes the system paged in from disk per second.
    • pgpgout/s — total number of kibibytes the system paged out to disk per second.
    • fault/s — number of page faults (major + minor) made by the system per second. this is not a count of page faults that generate I/O, because some page faults can be resolved without I/O. sneakyyy 👀
    • majflt/s — number of major faults the system has made per second, those which have required loading a memory page from disk.
    • pgfree/s — number of pages placed on the free list by the system per second.
    • pgscank/s — number of pages scanned by the kswapd daemon per second (done in background, healthy system). green flags only 🌿
    • pgscand/s — number of pages scanned directly per second (process is stalled). not the vibe 😬
    • pgsteal/s — number of pages the system has reclaimed from cache (pagecache and swapcache) per second to satisfy its memory demands.
    • pgprom/s — number of pages promoted (i.e. migrated from slow to fast memory types) by the system per second. glow up ✨
    • pgdem/s — number of pages demoted (i.e. migrated from fast to slow memory types) by the system per second. it's giving flop era 😔
  • -b — report I/O and transfer rate statistics. the following values are displayed:
    • tps — total number of transfers per second that were issued to physical devices. a transfer is an I/O request to a physical device. multiple logical requests can be combined into a single I/O request to the device. a transfer is of indeterminate size. mysterious. love that for her 🎀
    • rtps — total number of read requests per second issued to physical devices.
    • wtps — total number of write requests per second issued to physical devices.
    • dtps — total number of discard requests per second issued to physical devices.
    • bread/s — total amount of data read from the devices in blocks per second. blocks are equivalent to sectors and therefore have a size of 512 bytes.
    • bwrtn/s — total amount of data written to devices in blocks per second.
    • bdscd/s — total amount of data discarded for devices in blocks per second.
  • -C — when reading data from a file, tell sar to display comments that have been inserted by sadc. the commentary, the lore, the behind-the-scenes 💬
  • -D — use saYYYYMMDD instead of saDD as the standard system activity daily data file name. this option works only when used in conjunction with option -o to save data to file. solo it does nothing, bestie, it needs its plus-one 🫶
  • -d — report activity for each block device. when data are displayed, the device name is displayed as it (should) appear in /dev. sar uses data in /sys to determine the device name based on its major and minor numbers. if this name resolution fails, sar will use name mapping controlled by /etc/conf.d/sysstat.ioconf file. persistent device names can also be printed if option -j is used (see below). statistics for all devices are displayed unless a restricted list is specified using option --dev= (see corresponding option entry). note that disk activity depends on sadc's options -S DISK and -S XDISK to be collected. the following values are displayed:
    • tps — total number of transfers per second that were issued to physical devices. a transfer is an I/O request to a physical device. multiple logical requests can be combined into a single I/O request to the device. a transfer is of indeterminate size.
    • rkB/s — number of kibibytes read from the device per second.
    • wkB/s — number of kibibytes written to the device per second.
    • dkB/s — number of kibibytes discarded for the device per second.
    • areq-sz — the average size (in kibibytes) of the I/O requests that were issued to the device.
Note: in previous versions, this field was known as avgrq-sz and was expressed in sectors. rebrand era 💅
  • aqu-sz — the average queue length of the requests that were issued to the device.
Note: in previous versions, this field was known as avgqu-sz. another rebrand, we stay adapting 🦋
  • await — the average time (in milliseconds) for I/O requests issued to the device to be served. this includes the time spent by the requests in queue and the time spent servicing them. the whole journey, not just the destination 🚶‍♀️
  • %util — percentage of elapsed time during which I/O requests were issued to the device (bandwidth utilization for the device). device saturation occurs when this value is close to 100% for devices serving requests serially. but for devices serving requests in parallel, such as RAID arrays and modern SSDs, this number does not reflect their performance limits. don't @ her, she's doing her best 😤
  • --dec={ 0 | 1 | 2 } — specify the number of decimal places to use (0 to 2, default value is 2). pick your precision, pick your poison 🔢
  • --dev=dev_list — specify the block devices for which statistics are to be displayed by sar. dev_list is a list of comma-separated device names. keep it curated, keep it cute 🎀
  • -e [ hh:mm[:ss] ], -e [ seconds_since_the_epoch ] — sets the ending time of the report, bestie. Default ending time is 18:00:00 💖. Hours go in 24-hour format, or you can hand it the number of seconds since the epoch (as a 10 digit number). This option is usable when data are read from or written to a file (options -f or -o). So like… you can time-box your whole investigation, iconic.
  • -F [ MOUNT ] — shows stats for currently mounted filesystems ✨. Pseudo-filesystems get ignored, no cap. At the end of the report sar will display a summary of all those filesystems, which is giving wrap-up-slide energy 🎀. If you use the MOUNT parameter keyword, that means the mountpoint gets reported instead of the filesystem device. Stats for all filesystems are displayed unless you specify a restricted list using option --fs= (see the corresponding option entry, it's right below 👀). Note that filesystems statistics depend on sadc's option -S XDISK to be collected — like, they literally won't be there otherwise, so don't come for sar 🙈.

The following values are displayed:

  • MBfsfree — total amount of free space in mebibytes (including space available only to privileged user).
  • MBfsused — total amount of space used in mebibytes.
  • %fsused — percentage of filesystem space used, as seen by a privileged user.
  • %ufsused — percentage of filesystem space used, as seen by an unprivileged user.
  • Ifree — total number of free file nodes in filesystem.
  • Iused — total number of file nodes used in filesystem.
  • %Iused — percentage of file nodes used in filesystem.
  • -f [ filename ] — extracts records from filename (which was created by the -o filename flag, iykyk). The default value of the filename parameter is the current standard system activity daily data file. Plot twist: if filename is a directory instead of a plain file, then it's treated as the directory where the standard system activity daily data files are located 🗂️. Heads up: option -f is exclusive of option -o — they do not coexist, periodt.
  • --fs=fs_list — specifies the filesystems whose statistics sar should display 🌸. fs_list is a list of comma-separated filesystem device names (for example /dev/sdb1) and/or mountpoints (for example /srv). Either form is accepted for filtering, independent of whether option -F is showing device names or mountpoints — flexible queen behavior 👑.
  • -H — reports hugepages utilization statistics 💜. The following values are displayed:
    • kbhugfree — amount of hugepages memory in kibibytes that is not yet allocated.
    • kbhugused — amount of hugepages memory in kibibytes that has been allocated.
    • %hugused — percentage of total hugepages memory that has been allocated.
    • kbhugrsvd — amount of reserved hugepages memory in kibibytes.
    • kbhugsurp — amount of surplus hugepages memory in kibibytes.
  • -h — this option is equivalent to specifying --pretty --human. That's it, that's the whole vibe ✨.
  • --help — displays a short help message then exits. Cute, quick, bye 🫶.
  • --human — prints sizes in human readable format (e.g. 1.0k, 1.2M, etc.). The units displayed with this option supersede any other default units (e.g. kibibytes, sectors…) associated with the metrics — so it overrides, it does not negotiate 💅.
  • -I [ SUM | ALL ] — reports statistics for interrupts ⚡. The values displayed are the number of interrupts per second for the given processor or among all processors. A list of interrupts can be specified using --int= (see that option). The SUM keyword indicates that the total number of interrupts received per second is to be displayed. The ALL keyword indicates that statistics from all interrupts are to be reported (this is the default, bestie). Note that interrupts statistics depend on sadc's option -S INT to be collected.
  • -i interval — selects data records at seconds as close as possible to the number specified by the interval parameter. So it's not like, exactly exactly, it's as-close-as-possible 🎯.
  • --iface=iface_list — specifies the network interfaces whose statistics sar should display 🌈. iface_list is a list of comma-separated interface names.
  • --int=int_list — specifies the interrupts names whose statistics sar should display. int_list is a list of comma-separated values or range of values (e.g., 0-16,35,40-). Note the trailing dash — that's a real thing, not a typo, she's open-ended 💀.
  • -j { SID | ID | LABEL | PATH | UUID | ... } — displays persistent device names. Use this option in conjunction with option -d. Keywords ID, LABEL, etc. specify the type of the persistent name. These keywords are not limited — the only prerequisite is that a directory with the required persistent names is present in /dev/disk 🗂️. Keyword SID tries to get a stable identifier to use as the device name. A stable identifier won't change across reboots for the same physical device, which is the dream, honestly. If it exists, this identifier is normally the WWN (World Wide Name) of the device, as read from the /dev/disk/by-id directory 🦋.
  • -m { keyword[,...] | ALL } — reports power management statistics 🔋. Note that these statistics depend on sadc's option -S POWER to be collected.

Possible keywords are BAT, CPU, FAN, FREQ, IN, TEMP and USB.

With the BAT keyword, statistics about batteries capacity are reported. The following values are displayed:

  • %cap — battery capacity.
  • cap/min — capacity lost or gained per minute by the battery.
  • status — charging status of the battery: ↑ (full), ↗ (charging), → (not charging), ↘ (discharging), ? (unknown). Tiny drama arrows, we love to see it 😭.

With the CPU keyword, statistics about CPU are reported. The following value is displayed:

  • MHz — instantaneous CPU clock frequency in MHz.

With the FAN keyword, statistics about fans speed are reported. The following values are displayed:

  • rpm — fan speed expressed in revolutions per minute.
  • drpm — this field is calculated as the difference between current fan speed (rpm) and its low limit (fan_min).
  • DEVICE — sensor device name.

With the FREQ keyword, statistics about CPU clock frequency are reported. The following value is displayed:

  • wghMHz — weighted average CPU clock frequency in MHz. Note that the cpufreq-stats driver must be compiled in the kernel for this option to work — no driver, no numbers, just vibes 🌸.

With the IN keyword, statistics about voltage inputs are reported. The following values are displayed:

  • inV — voltage input expressed in Volts.
  • %in — relative input value. A value of 100% means that voltage input has reached its high limit (in_max) whereas a value of 0% means that it has reached its low limit (in_min).
  • DEVICE — sensor device name.

With the TEMP keyword, statistics about devices temperature are reported. The following values are displayed:

  • degC — device temperature expressed in degrees Celsius.
  • %temp — relative device temperature. A value of 100% means that temperature has reached its high limit (temp_max).
  • DEVICE — sensor device name.

With the USB keyword, the sar command takes a snapshot of all the USB devices currently plugged into the system 🔌. At the end of the report, sar will display a summary of all those USB devices. The following values are displayed:

  • BUS — root hub number of the USB device.
  • idvendor — vendor ID number (assigned by USB organization).
  • idprod — product ID number (assigned by Manufacturer).
  • maxpower — maximum power consumption of the device (expressed in mA).
  • manufact — manufacturer name.
  • product — product name.

The ALL keyword is equivalent to specifying all the keywords above and therefore all the power management statistics are reported — the full menu, no skips 💅.

  • -n { keyword[,...] | ALL } — reports network statistics 🌐.

Possible keywords are DEV, EDEV, FC, ICMP, EICMP, ICMP6, EICMP6, IP, EIP, IP6, EIP6, NFS, NFSD, SOCK, SOCK6, SOFT, TCP, ETCP, UDP and UDP6.

With the DEV keyword, statistics from the network devices are reported. Statistics for all network interfaces are displayed unless a restricted list is specified using option --iface= (see the corresponding option entry). The following values are displayed:

  • IFACE — name of the network interface for which statistics are reported.
  • rxpck/s — total number of packets received per second.
  • txpck/s — total number of packets transmitted per second.
  • rxkB/s — total number of kibibytes received per second.
  • txkB/s — total number of kibibytes transmitted per second.
  • rxcmp/s — number of compressed packets received per second (for cslip etc.).
  • txcmp/s — number of compressed packets transmitted per second.
  • rxmcst/s — number of multicast packets received per second.
  • %ifutil — utilization percentage of the network interface. For half-duplex interfaces, utilization is calculated using the sum of rxkB/s and txkB/s as a percentage of the interface speed. For full-duplex, this is the greater of rxkB/S or txkB/s. (Yes, that capital S is exactly how it's written in the original — copying it verbatim, bestie 🤝.)

With the EDEV keyword, statistics on failures (errors) from the network devices are reported. Statistics for all network interfaces are displayed unless a restricted list is specified using option --iface= (see the corresponding option entry). The following values are displayed:

  • IFACE — name of the network interface for which statistics are reported.
  • rxerr/s — total number of bad packets received per second.
  • txerr/s — total number of errors that happened per second while transmitting packets.
  • coll/s — number of collisions that happened per second while transmitting packets.
  • rxdrop/s — number of received packets dropped per second because of a lack of space in linux buffers.
  • txdrop/s — number of transmitted packets dropped per second because of a lack of space in linux buffers.
  • txcarr/s — how many carrier-errors went down per second while we were transmitting packets 💀
  • rxfram/s — how many frame alignment errors happened per second on the packets we received 🫠
  • rxfifo/s — how many FIFO overrun errors happened per second on received packets
  • txfifo/s — how many FIFO overrun errors happened per second on transmitted packets

🦋 the FC keyword

okay so when you use the FC keyword, you get stats about fibre channel traffic. heads up tho: fibre channel numbers only exist if sadc was run with the -S DISK option to actually collect them. iykyk. here's what shows up:

  • FCHOST — the name of the fibre channel host bus adapter (HBA) interface these stats are for 🎀
  • fch_rxf/s — total frames received per second
  • fch_txf/s — total frames transmitted per second
  • fch_rxw/s — total transmission words received per second
  • fch_txw/s — total transmission words transmitted per second

🌈 the ICMP keyword

ICMP gives you stats about ICMPv4 network traffic 💖 btw these depend on sadc's -S SNMP option being used to collect them, so like… no collection, no data, no cap. formal SNMP names are in the square brackets, bestie:

  • imsg/s — total number of ICMP messages this entity received per second [icmpInMsgs]. not me telling you this counter includes everything counted by ierr/s 🙈
  • omsg/s — total number of ICMP messages this entity tried to send per second [icmpOutMsgs]. and yeah, this one includes everything counted by oerr/s.
  • iech/s — number of ICMP Echo (request) messages received per second [icmpInEchos]
  • iechr/s — number of ICMP Echo Reply messages received per second [icmpInEchoReps]
  • oech/s — number of ICMP Echo (request) messages sent per second [icmpOutEchos]
  • oechr/s — number of ICMP Echo Reply messages sent per second [icmpOutEchoReps]
  • itm/s — number of ICMP Timestamp (request) messages received per second [icmpInTimestamps]
  • itmr/s — number of ICMP Timestamp Reply messages received per second [icmpInTimestampReps]
  • otm/s — number of ICMP Timestamp (request) messages sent per second [icmpOutTimestamps]
  • otmr/s — number of ICMP Timestamp Reply messages sent per second [icmpOutTimestampReps]
  • iadrmk/s — number of ICMP Address Mask Request messages received per second [icmpInAddrMasks]
  • iadrmkr/s — number of ICMP Address Mask Reply messages received per second [icmpInAddrMaskReps]
  • oadrmk/s — number of ICMP Address Mask Request messages sent per second [icmpOutAddrMasks]
  • oadrmkr/s — number of ICMP Address Mask Reply messages sent per second [icmpOutAddrMaskReps]

💅 the EICMP keyword

EICMP is the error-message era of ICMPv4 ✨ same deal as before: these depend on sadc's -S SNMP option to be collected. SNMP names, in brackets, as always:

  • ierr/s — number of ICMP messages per second the entity received but clocked as having ICMP-specific errors (bad ICMP checksums, bad length, etc.) [icmpInErrors] 😭
  • oerr/s — number of ICMP messages per second this entity did not send because of problems found inside ICMP, like a lack of buffers [icmpOutErrors]
  • idstunr/s — number of ICMP Destination Unreachable messages received per second [icmpInDestUnreachs]
  • odstunr/s — number of ICMP Destination Unreachable messages sent per second [icmpOutDestUnreachs]
  • itmex/s — number of ICMP Time Exceeded messages received per second [icmpInTimeExcds]
  • otmex/s — number of ICMP Time Exceeded messages sent per second [icmpOutTimeExcds]
  • iparmpb/s — number of ICMP Parameter Problem messages received per second [icmpInParmProbs]
  • oparmpb/s — number of ICMP Parameter Problem messages sent per second [icmpOutParmProbs]
  • isrcq/s — number of ICMP Source Quench messages received per second [icmpInSrcQuenchs]
  • osrcq/s — number of ICMP Source Quench messages sent per second [icmpOutSrcQuenchs]
  • iredir/s — number of ICMP Redirect messages received per second [icmpInRedirects]
  • oredir/s — number of ICMP Redirect messages sent per second [icmpOutRedirects]

🧚 the ICMP6 keyword

now we're in ICMPv6 network traffic territory 🦋 these stats depend on sadc's -S IPV6 option being collected — fr fr, don't forget it. formal SNMP names between square brackets:

  • imsg6/s — total number of ICMP messages received by the interface per second, which includes everything counted by ierr6/s [ipv6IfIcmpInMsgs]
  • omsg6/s — total number of ICMP messages this interface tried to send per second [ipv6IfIcmpOutMsgs]
  • iech6/s — number of ICMP Echo (request) messages received by the interface per second [ipv6IfIcmpInEchos]
  • iechr6/s — number of ICMP Echo Reply messages received by the interface per second [ipv6IfIcmpInEchoReplies]
  • oechr6/s — number of ICMP Echo Reply messages sent by the interface per second [ipv6IfIcmpOutEchoReplies]
  • igmbq6/s — number of ICMPv6 Group Membership Query messages received by the interface per second [ipv6IfIcmpInGroupMembQueries]
  • igmbr6/s — number of ICMPv6 Group Membership Response messages received by the interface per second [ipv6IfIcmpInGroupMembResponses]
  • ogmbr6/s — number of ICMPv6 Group Membership Response messages sent per second [ipv6IfIcmpOutGroupMembResponses]
  • igmbrd6/s — number of ICMPv6 Group Membership Reduction messages received by the interface per second [ipv6IfIcmpInGroupMembReductions]
  • ogmbrd6/s — number of ICMPv6 Group Membership Reduction messages sent per second [ipv6IfIcmpOutGroupMembReductions]
  • irtsol6/s — number of ICMP Router Solicit messages received by the interface per second [ipv6IfIcmpInRouterSolicits]
  • ortsol6/s — number of ICMP Router Solicitation messages sent by the interface per second [ipv6IfIcmpOutRouterSolicits]
  • irtad6/s — number of ICMP Router Advertisement messages received by the interface per second [ipv6IfIcmpInRouterAdvertisements]
  • inbsol6/s — number of ICMP Neighbor Solicit messages received by the interface per second [ipv6IfIcmpInNeighborSolicits]
  • onbsol6/s — number of ICMP Neighbor Solicitation messages sent by the interface per second [ipv6IfIcmpOutNeighborSolicits]
  • inbad6/s — number of ICMP Neighbor Advertisement messages received by the interface per second [ipv6IfIcmpInNeighborAdvertisements]
  • onbad6/s — number of ICMP Neighbor Advertisement messages sent by the interface per second [ipv6IfIcmpOutNeighborAdvertisements]

🔥 the EICMP6 keyword

and finally the ICMPv6 error messages 💜 (these also depend on sadc's -S IPV6 option to be collected, obvs). SNMP names in the brackets:

  • ierr6/s — number of ICMP messages per second the interface received but determined as having ICMP-specific errors (bad ICMP checksums, bad length, etc.) [ipv6IfIcmpInErrors]
  • idtunr6/s — number of ICMP Destination Unreachable messages received by the interface per second [ipv6IfIcmpInDestUnreachs]
  • odtunr6/s — number of ICMP Destination Unreachable messages sent by the interface per second [ipv6IfIcmpOutDestUnreachs]
  • itmex6/s — number of ICMP Time Exceeded messages received by the interface per second [ipv6IfIcmpInTimeExcds]
  • otmex6/s — number of ICMP Time Exceeded messages sent by the interface per second [ipv6IfIcmpOutTimeExcds]
  • iprmpb6/s — number of ICMP Parameter Problem messages received by the interface per second [ipv6IfIcmpInParmProblems]
  • oprmpb6/s — number of ICMP Parameter Problem messages sent by the interface per second [ipv6IfIcmpOutParmProblems]
  • iredir6/s — number of Redirect messages received by the interface per second [ipv6IfIcmpInRedirects]
  • oredir6/s — number of Redirect messages sent by the interface by second [ipv6IfIcmpOutRedirects]
  • ipck2b6/s — number of ICMP Packet Too Big messages received by the interface per second [ipv6IfIcmpInPktTooBigs]
  • opck2b6/s — number of ICMP Packet Too Big messages sent by the interface per second [ipv6IfIcmpOutPktTooBigs]

Okay so, quick vibe check before we dive in: every single one of these counters has its formal SNMP name hanging out in square brackets right next to it. That's your iykyk moment — the bracket names are the real ones, the short names are the vibe.

With the IP keyword, we're talking alllll about IPv4 network traffic stats, bestie. 💙 And listen — IPv4 stats only show up if sadc was run with option -S SNMP, so no -S SNMP, no stats, periodt. Here's the roster of values (formal SNMP names in square brackets, as always):

  • irec/s — total number of input datagrams received from interfaces per second, error ones included, no gatekeeping [ipInReceives].
  • fwddgm/s — number of input datagrams per second where this entity was not the final IP destination, so it tried to find a route to forward them on to that final destination [ipForwDatagrams].
  • idel/s — total number of input datagrams successfully delivered per second to IP user-protocols (ICMP included) [ipInDelivers].
  • orq/s — total number of IP datagrams that local IP user-protocols (ICMP included, again) handed over per second to IP asking for transmission [ipOutRequests]. Heads up though: this counter does not include any datagrams already counted in fwddgm/s. 💅
  • asmrq/s — number of IP fragments received per second that needed reassembling at this entity [ipReasmReqds].
  • asmok/s — number of IP datagrams successfully re-assembled per second [ipReasmOKs].
  • fragok/s — number of IP datagrams successfully fragmented at this entity per second [ipFragOKs].
  • fragcrt/s — number of IP datagram fragments generated per second as a result of fragmentation at this entity [ipFragCreates].

Now with the EIP keyword, it's giving IPv4 network errors energy 😭 — the messy side of the family. Same deal: these depend on sadc's option -S SNMP to be collected. The values:

  • ihdrerr/s — number of input datagrams discarded per second because their IP headers were a whole mess: bad checksums, version number mismatch, other format errors, time-to-live exceeded, errors found while processing their IP options, etc. [ipInHdrErrors]
  • iadrerr/s — number of input datagrams discarded per second because the IP address in their IP header's destination field wasn't a valid address to be received at this entity. This count includes invalid addresses (e.g., 0.0.0.0) and addresses of unsupported Classes (e.g., Class E). And for entities that aren't IP routers and therefore don't forward datagrams, this counter also includes datagrams discarded because the destination address wasn't a local address [ipInAddrErrors].
  • iukwnpr/s — number of locally-addressed datagrams received successfully but then discarded per second because of an unknown or unsupported protocol [ipInUnknownProtos]. rude, honestly.
  • idisc/s — number of input IP datagrams per second that hit no problems that would stop further processing, but got discarded anyway (like, for lack of buffer space) [ipInDiscards]. Note that this counter does not include any datagrams discarded while awaiting re-assembly.
  • odisc/s — number of output IP datagrams per second that hit no problem preventing transmission to their destination but got discarded anyway (again, lack of buffer space being the classic) [ipOutDiscards]. Also note: this counter would include datagrams counted in fwddgm/s if any such packets met this (discretionary) discard criterion.
  • onort/s — number of IP datagrams discarded per second because no route could be found to transmit them to their destination [ipOutNoRoutes]. Note: this counter includes any packets counted in fwddgm/s that meet this 'no-route' criterion. Also note it includes any datagrams a host can't route because all of its default routers are down. 💀
  • asmf/s — number of failures detected per second by the IP re-assembly algorithm, for whatever reason (timed out, errors, etc.) [ipReasmFails]. Important nuance: this is not necessarily a count of discarded IP fragments, because some algorithms can lose track of how many fragments there are by combining them as they're received.
  • fragf/s — number of IP datagrams discarded per second because they needed fragmenting at this entity and couldn't be — like when their Don't Fragment flag was set [ipFragFails].

Switching it up: the IP6 keyword reports IPv6 network traffic stats 🦋✨. And yes, IPv6 statistics depend on sadc's option -S IPV6 to be collected — different flag, don't mix them up. The values:

  • irec6/s — total number of input datagrams received from interfaces per second, including the ones received in error [ipv6IfStatsInReceives].
  • fwddgm6/s — number of output datagrams per second that this entity received and forwarded to their final destinations [ipv6IfStatsOutForwDatagrams].
  • idel6/s — total number of datagrams successfully delivered per second to IPv6 user-protocols (ICMP included) [ipv6IfStatsInDelivers].
  • orq6/s — total number of IPv6 datagrams local IPv6 user-protocols (ICMP included) supplied per second to IPv6 in requests for transmission [ipv6IfStatsOutRequests]. Note that this counter does not include any datagrams counted in fwddgm6/s.
  • asmrq6/s — number of IPv6 fragments received per second that needed reassembling at this interface [ipv6IfStatsReasmReqds].
  • asmok6/s — number of IPv6 datagrams successfully reassembled per second [ipv6IfStatsReasmOKs].
  • imcpck6/s — number of multicast packets received per second by the interface [ipv6IfStatsInMcastPkts].
  • omcpck6/s — number of multicast packets transmitted per second by the interface [ipv6IfStatsOutMcastPkts].
  • fragok6/s — number of IPv6 datagrams successfully fragmented at this output interface per second [ipv6IfStatsOutFragOKs].
  • fragcr6/s — number of output datagram fragments generated per second as a result of fragmentation at this output interface [ipv6IfStatsOutFragCreates].

And the EIP6 keyword? That's IPv6 network errors 🌸 — yep, it's the same depend-on-sadc's-option--S IPV6 situation, and yep, brackets mean formal SNMP names. Behold:

  • ihdrer6/s — number of input datagrams discarded per second due to errors in their IPv6 headers: version number mismatch, other format errors, hop count exceeded, errors discovered while processing their IPv6 options, etc. [ipv6IfStatsInHdrErrors]
  • iadrer6/s — number of input datagrams discarded per second because the IPv6 address in their IPv6 header's destination field wasn't a valid address to be received at this entity. This count includes invalid addresses (e.g., ::0) and unsupported addresses (e.g., addresses with unallocated prefixes). For entities that aren't IPv6 routers and therefore don't forward datagrams, this counter also includes datagrams discarded because the destination address wasn't a local address [ipv6IfStatsInAddrErrors].
  • iukwnp6/s — number of locally-addressed datagrams received successfully but discarded per second because of an unknown or unsupported protocol [ipv6IfStatsInUnknownProtos].
  • i2big6/s — number of input datagrams that could not be forwarded per second because their size exceeded the link MTU of the outgoing interface [ipv6IfStatsInTooBigErrors]. too big, too slay, too discarded.
  • idisc6/s — number of input IPv6 datagrams per second with no problems preventing continued processing, but discarded anyway (lack of buffer space, the usual suspect) [ipv6IfStatsInDiscards]. Note that this counter does not include any datagrams discarded while awaiting re-assembly.
  • odisc6/s — number of output IPv6 datagrams per second with no problem preventing transmission to their destination, but discarded anyway (buffer space, etc.) [ipv6IfStatsOutDiscards]. Note that this counter would include datagrams counted in fwddgm6/s if any such packets met this (discretionary) discard criterion.
  • inort6/s — number of input datagrams discarded per second because no route could be found to transmit them to their destination [ipv6IfStatsInNoRoutes].
  • onort6/s — number of locally generated IP datagrams discarded per second because no route could be found to transmit them to their destination [unknown formal SNMP name]. yes, that bracket really does say unknown formal SNMP name — it's not a typo, that's just the lore 🙈
  • asmf6/s — the number of failures the IPv6 reassembly algorithm caught per second, for literally whatever reason (timed out, errors, etc.) — that's [ipv6IfStatsReasmFails] bestie. Quick heads up tho: this is not necessarily a count of discarded IPv6 fragments, because some algorithms can lose track of the fragment count by combining them as they come in. so the vibes are approximate, not exact 💅
  • fragf6/s — how many IPv6 datagrams got yeeted per second because they needed fragmenting at this output interface but just... couldn't — [ipv6IfStatsOutFragFails]. it's giving "we tried and we failed" 😭
  • itrpck6/s — the number of input datagrams discarded per second because the datagram frame didn't carry enough data — [ipv6IfStatsInTruncatedPkts]. short king packets, not slaying 🌸

🌈 the NFS keyword — client tea

With the NFS keyword, statistics about NFS client activity are reported. The following values are displayed:

  • call/s — number of RPC requests made per second.
  • retrans/s — number of RPC requests per second that needed to be retransmitted (for example, because a server timed out). the flaky wifi of RPC 🔥
  • read/s — number of 'read' RPC calls made per second.
  • write/s — number of 'write' RPC calls made per second.
  • access/s — number of 'access' RPC calls made per second.
  • getatt/s — number of 'getattr' RPC calls made per second.

👑 the NFSD keyword — server tea

With the NFSD keyword, statistics about NFS server activity are reported. The following values are displayed:

  • scall/s — number of RPC requests received per second.
  • badcall/s — number of bad RPC requests received per second — the ones whose processing generated an error. blocked and reported 💀
  • packet/s — number of network packets received per second.
  • udp/s — number of UDP packets received per second.
  • tcp/s — number of TCP packets received per second.
  • hit/s — number of reply cache hits per second. slay ✨
  • miss/s — number of reply cache misses per second. not slay 🙈
  • sread/s — number of 'read' RPC calls received per second.
  • swrite/s — number of 'write' RPC calls received per second.
  • saccess/s — number of 'access' RPC calls received per second.
  • sgetatt/s — number of 'getattr' RPC calls received per second.

🧚 the SOCK keyword — IPv4 sockets in use

With the SOCK keyword, statistics on sockets in use are reported (IPv4). The following values are displayed:

  • totsck — total number of sockets used by the system.
  • tcpsck — number of TCP sockets currently in use.
  • udpsck — number of UDP sockets currently in use.
  • rawsck — number of RAW sockets currently in use.
  • ip-frag — number of IP fragments currently in queue.
  • tcp-tw — number of TCP sockets in TIME_WAIT state. they're just standing there... waiting... 🫶

🦋 the SOCK6 keyword — IPv6 sockets in use

With the SOCK6 keyword, statistics on sockets in use are reported (IPv6). Note that IPv6 statistics depend on sadc's option -S IPV6 to be collected. The following values are displayed:

  • tcp6sck — number of TCPv6 sockets currently in use.
  • udp6sck — number of UDPv6 sockets currently in use.
  • raw6sck — number of RAWv6 sockets currently in use.
  • ip6-frag — number of IPv6 fragments currently in use.

⭐ the SOFT keyword — software-based network processing

With the SOFT keyword, statistics about software-based network processing are reported. The following values are displayed:

  • total/s — the total number of network frames processed per second.
  • dropd/s — the total number of network frames dropped per second because there was no room on the processing queue. full queue behavior, tragic 😭
  • squeezd/s — the number of times the softirq handler function terminated per second because its budget was consumed or the time limit was reached — but more work could have been done. so much potential, so little time 💀
  • rx_rps/s — the number of times the CPU has been woken up per second to process packets via an inter-processor interrupt.
  • flw_lim/s — the number of times the flow limit has been reached per second. Flow limiting is an optional RPS feature that can be used to limit the number of packets queued to the backlog for each flow to a certain amount. This can help ensure that smaller flows are processed even though much larger flows are pushing packets in. it's giving "let the little guys through" 🫶
  • blg_len — the length of the network backlog.

🔥 the TCP keyword — TCPv4 traffic

With the TCP keyword, statistics about TCPv4 network traffic are reported. Note that TCPv4 statistics depend on sadc's option -S SNMP to be collected. The following values are displayed (formal SNMP names between square brackets):

  • active/s — the number of times TCP connections have made a direct transition to the SYN-SENT state from the CLOSED state per second [tcpActiveOpens]. main character energy, initiating ✨
  • passive/s — the number of times TCP connections have made a direct transition to the SYN-RCVD state from the LISTEN state per second [tcpPassiveOpens].
  • iseg/s — the total number of segments received per second, including those received in error [tcpInSegs]. This count includes segments received on currently established connections.
  • oseg/s — the total number of segments sent per second, including those on current connections but excluding those containing only retransmitted octets [tcpOutSegs].

💜 the ETCP keyword — TCPv4 errors

With the ETCP keyword, statistics about TCPv4 network errors are reported. Note that TCPv4 statistics depend on sadc's option -S SNMP to be collected. The following values are displayed (formal SNMP names between square brackets):

  • atmptf/s — the number of times per second TCP connections have made a direct transition to the CLOSED state from either the SYN-SENT state or the SYN-RCVD state, plus the number of times per second TCP connections have made a direct transition to the LISTEN state from the SYN-RCVD state [tcpAttemptFails]. it didn't work out, no hard feelings 😭
  • estres/s — the number of times per second TCP connections have made a direct transition to the CLOSED state from either the ESTABLISHED state or the CLOSE-WAIT state [tcpEstabResets]. the breakup stat 💀
  • retrseg/s — the total number of segments retransmitted per second — that is, the number of TCP segments transmitted containing one or more previously transmitted octets [tcpRetransSegs]. round two, we go again 🔥
  • isegerr/s — the total number of segments received in error (e.g., bad TCP checksums) per second [tcpInErrs].
  • orsts/s — the number of TCP segments sent per second containing the RST flag [tcpOutRsts]. hanging up with attitude 🎀

🌸 the UDP keyword — UDPv4 traffic

With the UDP keyword, statistics about UDPv4 network traffic are reported. Note that UDPv4 statistics depend on sadc's option -S SNMP to be collected. The following values are displayed (formal SNMP names between square brackets):

  • idgm/s — the total number of UDP datagrams delivered per second to UDP users [udpInDatagrams].
  • odgm/s — the total number of UDP datagrams sent per second from this entity [udpOutDatagrams].
  • noport/s — the total number of received UDP datagrams per second for which there was no application at the destination port [udpNoPorts]. nobody home, iconic 🙈
  • idgmerr/s — the number of received UDP datagrams per second that could not be delivered for reasons other than the lack of an application at the destination port [udpInErrors].

🎀 the UDP6 keyword — UDPv6 traffic

With the UDP6 keyword, statistics about UDPv6 network traffic are reported. Note that UDPv6 statistics depend on sadc's option -S IPV6 to be collected. The following values are displayed (formal SNMP names between square brackets):

  • idgm6/s — the total number of UDP datagrams delivered per second to UDP users [udpInDatagrams].
  • odgm6/s — the total number of UDP datagrams sent per second from this entity [udpOutDatagrams].
  • noport6/s — the total number of received UDP datagrams per second for which there was no application at the destination port [udpNoPorts].
  • idgmer6/s — the number of received UDP datagrams per second that could not be delivered for reasons other than the lack of an application at the destination port [udpInErrors].

The ALL keyword is equivalent to specifying all the keywords above, and therefore all the network activities are reported. literally the whole buffet, eat up 🍓

✨ more OPTIONS ✨

  • -o [ filename ] — save the readings in the file in binary form. Each reading is in a separate record. The default value of the filename parameter is the current standard system activity daily data file. If filename is a directory instead of a plain file then it is considered as the directory where the standard system activity daily data files are located. Option -o is exclusive of option -f. All the data available from the kernel are saved in the file — in fact, sar calls its data collector sadc with the option -S ALL. See sadc(8) manual page.
ok so -o and -f are NOT friends, bestie. pick one. exclusive means exclusive 💅
  • -P { cpu_list | ALL } — report per-processor statistics for the specified processor or processors. cpu_list is a list of comma-separated values or range of values (e.g., 0,2,4-7,12-). Note that processor 0 is the first processor, and processor all is the global average among all processors. Specifying the ALL keyword reports statistics for each individual processor, and globally for all processors. Offline processors are not displayed. no showing up for offline CPUs, they're on a break 😌
  • -p, --pretty — make reports easier to read by a human. This option may be especially useful when displaying e.g., network interfaces or block devices statistics. she understood the assignment, she made it pretty 🎀✨
  • -q [ keyword[,...] | ALL ] — report system load and pressure-stall statistics. ooh tension 👀

Possible keywords are CPU, IO, LOAD, MEM and PSI.

💻 CPU — the pressure one

With the CPU keyword, CPU pressure statistics are reported. Here's what gets displayed:

  • %scpu-10 — percentage of the time that at least some runnable tasks were delayed because the CPU was unavailable to them, over the last 10 second window.
  • %scpu-60 — percentage of the time that at least some runnable tasks were delayed because the CPU was unavailable to them, over the last 60 second window.
  • %scpu-300 — percentage of the time that at least some runnable tasks were delayed because the CPU was unavailable to them, over the last 300 second window.
  • %scpu — percentage of the time that at least some runnable tasks were delayed because the CPU was unavailable to them, over the last time interval.

🗂️ IO — I/O pressure, bestie

With the IO keyword, I/O pressure statistics are reported. The following values are displayed:

  • %sio-10 — percentage of the time that at least some tasks lost waiting for I/O, over the last 10 second window.
  • %sio-60 — percentage of the time that at least some tasks lost waiting for I/O, over the last 60 second window.
  • %sio-300 — percentage of the time that at least some tasks lost waiting for I/O, over the last 300 second window.
  • %sio — percentage of the time that at least some tasks lost waiting for I/O, over the last time interval.
  • %fio-10 — percentage of the time during which all non-idle tasks were stalled waiting for I/O, over the last 10 second window.
  • %fio-60 — percentage of the time during which all non-idle tasks were stalled waiting for I/O, over the last 60 second window.
  • %fio-300 — percentage of the time during which all non-idle tasks were stalled waiting for I/O, over the last 300 second window.
  • %fio — percentage of the time during which all non-idle tasks were stalled waiting for I/O, over the last time interval.

📊 LOAD — queue length + load averages

With the LOAD keyword, queue length and load averages statistics are reported. The following values are displayed:

  • runq-sz — run queue length (number of tasks running or waiting for run time).
  • plist-sz — number of tasks in the task list.
  • ldavg-1 — system load average for the last minute. The load average is calculated as the average number of runnable or running tasks (R state), and the number of tasks in uninterruptible sleep (D state) over the specified interval.
  • ldavg-5 — system load average for the past 5 minutes.
  • ldavg-15 — system load average for the past 15 minutes.
  • blocked — number of tasks currently blocked, waiting for I/O to complete.

🧠 MEM — memory pressure, obviously

With the MEM keyword, memory pressure statistics are reported. The following values are displayed:

  • %smem-10 — percentage of the time during which at least some tasks were waiting for memory resources, over the last 10 second window.
  • %smem-60 — percentage of the time during which at least some tasks were waiting for memory resources, over the last 60 second window.
  • %smem-300 — percentage of the time during which at least some tasks were waiting for memory resources, over the last 300 second window.
  • %smem — percentage of the time during which at least some tasks were waiting for memory resources, over the last time interval.
  • %fmem-10 — percentage of the time during which all non-idle tasks were stalled waiting for memory resources, over the last 10 second window.
  • %fmem-60 — percentage of the time during which all non-idle tasks were stalled waiting for memory resources, over the last 60 second window.
  • %fmem-300 — percentage of the time during which all non-idle tasks were stalled waiting for memory resources, over the last 300 second window.
  • %fmem — percentage of the time during which all non-idle tasks were stalled waiting for memory resources, over the last time interval.

The PSI keyword is literally the same thing as specifying the CPU, IO and MEM keywords together, so all the pressure-stall statistics get reported. Two birds, one flag, no cap ✨

The ALL keyword is equivalent to specifying all the keywords above, so every single statistic shows up. It's giving "select all" energy 💅

  • -r [ ALL ] — report memory utilization statistics. The ALL keyword means all the memory fields should be displayed. The following values may be displayed:
    • kbmemfree — amount of free memory available in kibibytes.
    • kbavail — estimate of how much memory in kibibytes is available for starting new applications, without swapping. The estimate takes into account that the system needs some page cache to function well, and that not all reclaimable slab will be reclaimable, due to items being in use. The impact of those factors will vary from system to system. If not provided by the kernel, this field is the same as kbmemfree.
    • kbmemused — amount of used memory in kibibytes (calculated as total installed memory - kbavail).
    • %memused — percentage of used memory.
    • kbbuffers — amount of memory used as buffers by the kernel in kibibytes.
    • kbcached — amount of memory used to cache data by the kernel in kibibytes.
    • kbcommit — amount of memory in kibibytes needed for current workload. This is an estimate of how much RAM/swap is needed to guarantee that there never is out of memory.
    • %commit — percentage of memory needed for current workload in relation to the total amount of memory (RAM+swap). This number may be greater than 100% because the kernel usually overcommits memory. 😭 (not a bug, it's a feature)
    • kbactive — amount of active memory in kibibytes (memory that has been used more recently and usually not reclaimed unless absolutely necessary).
    • kbinact — amount of inactive memory in kibibytes (memory which has been less recently used. It is more eligible to be reclaimed for other purposes).
    • kbdirty — amount of memory in kibibytes waiting to get written back to the disk.
    • kbshmem — amount of shared memory in kibibytes (memory mostly used by tmpfs).
    • kbanonpg — amount of non-file backed pages in kibibytes mapped into userspace page tables.
    • kbslab — amount of memory in kibibytes used by the kernel to cache data structures for its own use.
    • kbkstack — amount of memory in kibibytes used for kernel stack space.
    • kbpgtbl — amount of memory in kibibytes dedicated to the lowest level of page tables.
    • kbvmused — amount of memory in kibibytes of used virtual address space.
  • -S — report swap space utilization statistics. The following values are displayed:
    • kbswpfree — amount of free swap space in kibibytes.
    • kbswpused — amount of used swap space in kibibytes.
    • %swpused — percentage of used swap space.
    • kbswpcad — amount of cached swap memory in kibibytes. This is memory that once was swapped out, is swapped back in but still also is in the swap area (if memory is needed it doesn't need to be swapped out again because it is already in the swap area. This saves I/O).
    • %swpcad — percentage of cached swap memory in relation to the amount of used swap space.
  • -s [ hh:mm[:ss] ]
  • -s [ seconds_since_the_epoch ] — set the starting time of the data, so sar extracts records time-tagged at, or following, the time you specified. 🕐 The default starting time is 08:00:00. Hours must be given in 24-hour format, or as the number of seconds since the epoch (given as a 10 digit number). Heads up bestie: this option can be used only when data are read from a file (option -f).
-s [ hh:mm[:ss] ]
-s [ seconds_since_the_epoch ]
  • --sadc — indicate which data collector is called by sar. If the data collector is sought in PATH then enter which sadc to know where it is located. iykyk 🕵️‍♀️
  • -t — when reading data from a daily data file, indicate that sar should display the timestamps in the original local time of the data file creator. Without this option, the sar command displays the timestamps in the user's local time. Time zone glow-up, iconic ✨
  • -u [ ALL ] — report CPU utilization. The ALL keyword means all the CPU fields should be displayed. The report may show the following fields:
    • %user — percentage of CPU utilization that occurred while executing at the user level (application). Note that this field includes time spent running virtual processors.
    • %usr — percentage of CPU utilization that occurred while executing at the user level (application). Note that this field does NOT include time spent running virtual processors. 👀
    • %nice — percentage of CPU utilization that occurred while executing at the user level with nice priority.
  • %system — Percentage of CPU utilization that occurred while executing at the system level (kernel). Note that this field includes time spent servicing hardware and software interrupts. 💅
  • %sys — Percentage of CPU utilization that occurred while executing at the system level (kernel). Note that this field does NOT include time spent servicing hardware or software interrupts. Read that twice, bestie.
  • %iowait — Percentage of time that the CPU or CPUs were idle during which the system had an outstanding disk I/O request.
  • %steal — Percentage of time spent in involuntary wait by the virtual CPU or CPUs while the hypervisor was servicing another virtual processor.
  • %irq — Percentage of time spent by the CPU or CPUs to service hardware interrupts.
  • %soft — Percentage of time spent by the CPU or CPUs to service software interrupts.
  • %guest — Percentage of time spent by the CPU or CPUs to run a virtual processor.
  • %gnice — Percentage of time spent by the CPU or CPUs to run a niced guest.
  • %idle — Percentage of time that the CPU or CPUs were idle and the system did not have an outstanding disk I/O request.
  • -V — Print version number then exit. Short, sweet, iconic.
  • -v — Report status of inode, file and other kernel tables. The following values are displayed:
    • dentunusd — Number of unused cache entries in the directory cache.
    • file-nr — Number of file handles used by the system.
    • inode-nr — Number of inode handlers used by the system.
    • pty-nr — Number of pseudo-terminals used by the system.
  • -W — Report swapping statistics. The following values are displayed:
    • pswpin/s — Total number of swap pages the system brought in per second.
    • pswpout/s — Total number of swap pages the system brought out per second.
  • -w — Report task creation and system switching activity. The following values are displayed:
    • proc/s — Total number of tasks created per second.
    • cswch/s — Total number of context switches per second.
  • -x — Extended reports: Display minimum and maximum values in addition to average ones at the end of the report. Extra detail, extra slay. ✨
  • -y — Report TTY devices activity. The following values are displayed:
    • rcvin/s — Number of receive interrupts per second for current serial line. Serial line number is given in the TTY column.
    • xmtin/s — Number of transmit interrupts per second for current serial line.
    • framerr/s — Number of frame errors per second for current serial line.
    • prtyerr/s — Number of parity errors per second for current serial line.
    • brk/s — Number of breaks per second for current serial line.
    • ovrun/s — Number of overrun errors per second for current serial line.
  • -z — Tell sar to omit output for any devices for which there was no activity during the sample period. Quiet devices get no screen time. 🎀

🌿 ENVIRONMENT 🌿

The sar command takes into account the following environment variables:

  • S_COLORS — By default statistics are displayed in color when the output is connected to a terminal. Use this variable to change the settings. Possible values for this variable are never, always or auto (the latter is equivalent to the default settings). Please note that the color (being red, yellow, or some other color) used to display a value is not indicative of any kind of issue simply because of the color. It only indicates different ranges of values. Color = range info, not drama. 👑
  • S_COLORS_SGR — Specify the colors and other attributes used to display statistics on the terminal. Its value is a colon-separated list of capabilities that defaults to:
C=33;22:I=32;22:N=34;1:R=31;22:W=35;1:X=31;1:Z=34;22+=32;1:-=31;1

Supported capabilities are:

  • C= — SGR (Select Graphic Rendition) substring for comments inserted in the binary daily data files.
  • I= — SGR substring for item names or values (eg. network interfaces, CPU number...).
  • N= — SGR substring for non-zero statistics values.
  • R= — SGR substring for restart messages.
  • W= (or M=) — SGR substring for percentage values in the range from 75% to 90% (or in the range 10% to 25% depending on the metric's meaning). It is also used for negative values in the range from -10 to -5.
  • X= (or H=) — SGR substring for percentage values greater than or equal to 90% (or lower than or equal to 10% depending on the metric's meaning). It is also used for negative values lower than or equal to -10.
  • Z= — SGR substring for zero values.
  • += — SGR substring for battery status (full or charging).
  • -= — SGR substring for battery status (not charging or discharging).
  • S_REPEAT_HEADER — This variable contains the maximum number of lines after which a header has to be displayed by sar when the output is not a terminal. Header repetition, but make it configurable.
  • S_TIME_DEF_TIME — If this variable exists and its value is UTC then sar will save its data in UTC time (data will still be displayed in local time). sar will also use UTC time instead of local time to determine the current daily data file located in the /var/log/sa directory. This variable may be useful for servers with users located across several timezones. 🌍
  • S_TIME_FORMAT — If this variable exists and its value is ISO then the current locale will be ignored when printing the date in the report header. The sar command will use the ISO 8601 format (YYYY-MM-DD) instead. The timestamp will also be compliant with ISO 8601 format. Date format glow-up. ✨

🧪 EXAMPLES 🧪

sar -u 2 5

Report CPU utilization for each 2 seconds. 5 lines are displayed.

sar -I --int=14 -o int14.file 2 10

Report statistics on IRQ 14 for each 2 seconds. 10 lines are displayed. Data are stored in a file called int14.file.

sar -r -n DEV -f /var/log/sa/sa16

Display memory and network statistics saved in daily data file sa16.

sar -A

Display all the statistics saved in current daily data file. All the stats, no crumbs left. 💅

💀 BUGS 💀

/proc filesystem must be mounted for the sar command to work. No /proc, no party. 😭

All the statistics are not necessarily available, depending on the kernel version used. sar assumes that you are using at least a 2.6 kernel.

Although sar displays units corresponding to kilobytes (kB), megabytes (MB)..., it actually uses kibibytes (kiB), mebibytes (MiB)... A kibibyte is equal to 1024 bytes, and a mebibyte is equal to 1024 kibibytes. Yes, the labels are a little sus — the math is still 1024-based.

📁 FILES 📁

  • /var/log/sa/saDD
  • /var/log/sa/saYYYYMMDD

The standard system activity daily data files and their default location. YYYY stands for the current year, MM for the current month and DD for the current day. 🗓️

  • /proc and /sys contain various files with system statistics.

👑 AUTHOR 👑

Sebastien Godard (sysstat <at> orange.fr) 🫶

🔗 SEE ALSO 🔗

sadc(8), sa1(8), sa2(8), sadf(1), sysstat(5), pidstat(1), mpstat(1), iostat(1), vmstat(8)

https://github.com/sysstat/sysstat

https://sysstat.github.io/

That's the page, bestie. Source/version line says Linux, date says AUGUST 2026, and this iconic little manual is SAR(1) — periodt. 💖✨🎀

📦 where this page comes from