I'd like to know if I can get memory in sar the same way I get it from free. Currently free shows me a memory usage of 47.06% (16956/36027)*100 [used/total x 100]. Whereas sar is showing me a usage of almost 100%. The benefit of sar is that in my system, I can read values for the last 30 days, whereas free is just the current moment. Is there any way to see in sar values similar to those shown by free?

We have a Red Hat Kafka servers, and the disk utilization on the Kafka disk is very high almost 100%. What we observe from the sar command is that the values of rd_sec/s and wr_sec/s are high. The question is: how can we determine if these values exceed the threshold? The Kafka disk is a RAID 10 disk with a size of 10 TB. So, how can we identify the threshold for read and write operations to the disk? For example, can we say that values greater than 1,000,000 rd_sec/s and wr_sec/s are considered high? sar -d -p | grep sda 04:05:24 PM DEV tps rd_sec/s wr_sec/s avgrq-sz avgqu-sz await svctm %util 04:05:41 PM sda 496.00 82624.00 0.00 166.58 49.43 93.84 2.02 100.10 04:05:42 PM sda 3686.00 90528.00 2877784.00 805.29 46.88 14.00 0.27 100.00 04:05:43 PM sda 644.00 106208.00 10576.00 181.34 49.16 71.65 1.55 100.10 04:05:44 PM sda 493.00 81016.00 328.00 165.00 47.27 89.59 2.03 100.00 04:05:45 PM sda 1515.00 257952.00 2944.00 172.21 29.20 26.59 0.66 100.00 04:05:46 PM sda 2202.00 366560.00 0.00 166.47 18.77 8.12 0.45 100.00 04:05:47 PM sda 4262.00 187016.00 2784160.00 697.13 41.59 7.48 0.23 100.10 04:05:48 PM sda 239.00 38144.00 0.00 159.60 49.27 163.82 4.18 100.00 04:05:49 PM sda 468.00 77872.00 968.00 168.46 47.61 142.10 2.14 100.00 04:05:50 PM sda 2185.00 368568.00 0.00 168.68 19.22 9.47 0.46 100.00 04:05:51 PM sda 2273.00 369520.00 0.00 162.57 20.25 8.96 0.44 100.00 04:05:52 PM sda 2331.00 260432.00 698720.00 411.48 34.09 11.69 0.43 100.00 04:05:53 PM sda 1492.00 247320.00 0.00 165.76 35.85 28.13 0.67 100.00 04:05:54 PM sda 2375.00 392224.00 840.00 165.50 22.43 9.50 0.42 100.00 04:05:55 PM sda 2686.00 439160.00 0.00 163.50 22.87 8.82 0.38 102.00

I'm trying to enable sysstat to take temperature readings, so that I have past temperature information to diagnose host failures in the future. I tried this command to get temperature information:

$ sar -m TEMP
Requested activities not available in file /var/log/sysstat/sa22

Here's what the sar man page has to say about this:

-m { keyword [,...] | ALL }
       Report power management statistics.  Note that these statistics depend on sadc's option "-S  POWER"  to
       be collected.

       Possible keywords are CPU, FAN, FREQ, IN, TEMP and USB.

       [...]

       With  the  TEMP  keyword,  statistics about devices temperature are reported.  The following values are
       displayed:

According to this, power management information (which temperature is a subset of) is not logged by default. So, I changed the file /etc/sysstat/sysstat to enable it. I changed this:

# Parameters for the system activity data collector (see sadc(8) manual page)
# which are used for the generation of log files.
# By default contains the `-S DISK' option responsible for generating disk
# statisitcs. Use `-S XALL' to collect all available statistics.
SADC_OPTIONS="-S DISK"

into this:

SADC_OPTIONS="-S DISK,POWER"

Another issue on the [sysstat issue tracker](https://github.com/sysstat/sysstat/issues/156) said that sysstat requires lm-sensors to function, so I installed that package too. Here's the output of sensors:

$ sensors
acpitz-acpi-0
Adapter: ACPI interface
temp1:        +27.8°C  (crit = +119.0°C)
temp2:        +29.8°C  (crit = +119.0°C)

coretemp-isa-0000
Adapter: ISA adapter
Package id 0:  +89.0°C  (high = +82.0°C, crit = +100.0°C)
Core 0:        +86.0°C  (high = +82.0°C, crit = +100.0°C)
Core 1:        +88.0°C  (high = +82.0°C, crit = +100.0°C)
Core 2:        +89.0°C  (high = +82.0°C, crit = +100.0°C)
Core 3:        +89.0°C  (high = +82.0°C, crit = +100.0°C)
Core 4:        +88.0°C  (high = +82.0°C, crit = +100.0°C)
Core 5:        +87.0°C  (high = +82.0°C, crit = +100.0°C)

nvme-pci-0800
Adapter: PCI adapter
Composite:    +38.9°C  (low  = -273.1°C, high = +84.8°C)
                       (crit = +84.8°C)
Sensor 1:     +38.9°C  (low  = -273.1°C, high = +65261.8°C)
Sensor 2:     +37.9°C  (low  = -273.1°C, high = +65261.8°C)

So this does seem to correctly detect my temperature sensors. I also tried waiting ten minutes for another collection to happen. (My system is configured to log every ten minutes, at :05, :15, :25, etc.) Unfortunately, after all that, I still get the same error:

$ sar -m TEMP
Requested activities not available in file /var/log/sysstat/sa22

I'm currently investigating why I didn't get notified about a high memory utilization on one RHEL server from dynatrace. When checking the graphs of memory usage, both *sar* and *dynatrace* show different results.
On SAR it is showing that the server is using 90% for about 11 hours, here's the screenshot of that: And on the same day this is what dynatrace shows: And as you can see they are both from May 3 2024. The metric they are using is memory usage %. I'm very confused about these two graphs, I'm not an expert on sar so maybe I'm missing something else, if somebody could help me to find out if I'm missing something that will be very appreciated!

I would like to ask question about the output from sar -q . I appreciate if someone can help me out with understanding runq-sz. I have a system which cpu threads are 8 cpu threads on RHEL 7.2 . [ywatanabe@host2 ~]$ cat /proc/cpuinfo | grep processor | wc -l 8 Below is sar -q result from my system but runq-sz seems to be **low** compared to ldavg-1 . runq-sz plist-sz ldavg-1 ldavg-5 ldavg-15 blocked 05:10:01 PM 0 361 0.29 1.68 2.14 0 05:11:01 PM 0 363 1.18 1.61 2.08 2 05:12:01 PM 0 363 7.03 3.15 2.58 1 05:13:01 PM 0 365 8.12 4.15 2.96 1 05:14:01 PM 3 371 7.40 4.64 3.20 1 05:15:01 PM 2 370 7.57 5.26 3.51 1 05:16:01 PM 0 366 8.42 5.90 3.84 1 05:17:01 PM 0 365 8.78 6.45 4.16 1 05:18:01 PM 0 363 7.05 6.40 4.28 2 05:19:02 PM 1 364 8.05 6.74 4.53 0 05:20:01 PM 0 367 7.96 6.96 4.74 1 05:21:01 PM 0 367 7.86 7.11 4.93 1 05:22:01 PM 1 366 7.84 7.31 5.14 0 From the man sar , I was thinking that runq-sz represents the number of tasks inside the run queue which states are TASK_RUNNING which corresponds to R sate in ps . runq-sz Run queue length (number of tasks waiting for run time). What does runq-sz actually represent ?

sar is a great tool to log various resource usage metrics, regarding CPU, memory, I/O, network... ...but not GPU? I won't be remotely original by stressing the importance of logging GPU usage metrics (load, temperature, etc.) for some of us. Is there a way to have sar aware of those probes and log their values along the other metrics?

from sar command on saX file we can get the disks utilization as the follwing sar -d -f /var/log/sa/sa18 | grep Average Average: dev8-0 1.24 0.00 150.06 121.40 0.04 30.40 4.72 0.58 Average: dev253-0 0.32 0.00 3.75 11.83 0.01 17.95 3.48 0.11 Average: dev253-1 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 Average: dev253-2 1.12 0.00 146.31 130.68 0.04 31.79 4.46 0.50 Average: dev8-16 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 Average: dev8-32 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 Average: dev8-48 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 Average: dev253-3 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 we can see that disks defined as MAJ:MIN as ( dev8-16 , dev8-48 , etc ) is it possible to get the real disks name as sdb , sdc sdc , etc ? using the sar cli ( sar -d -f /var/log/sa/sa18 | grep Average )

I want to get the per processor statistics for my AIX machines. I can use the ‘**sar -P ALL 1 1**’ (Documentation ) command but it requires root privileges. Is there a command that can give me PER PROCESSOR statistics **without requiring root privileges**? P.S. : I explored **lparstat** but it does not give PER PROCESSOR statistics.

I am having issues with SAR not populating daily logs from the 10 minute interval runs it is supposed to be doing. I have the same configuration on multiple servers, and they are running sar just fine. Here is an example of the setup: -CentOS 6 -sysstat 9.0.4

# cat /etc/sysconfig/sysstat
# sysstat-9.0.4 configuration file.
# How long to keep log files (in days).
# If value is greater than 28, then log files are kept in
# multiple directories, one for each month.
HISTORY=28
# Compress (using gzip or bzip2) sa and sar files older than (in days):
COMPRESSAFTER=31
# Parameters for the system activity data collector (see sadc manual page)
# which are used for the generation of log files.
SADC_OPTIONS="-S DISK"
# Compression program to use.
ZIP="bzip2"


# cat /etc/crond./sysstat
# Run system activity accounting tool every 10 minutes
*/5 * * * * root /usr/lib64/sa/sa1 1 1
# 0 * * * * root /usr/lib64/sa/sa1 600 6 &
# Generate a daily summary of process accounting at 23:53
53 23 * * * root /usr/lib64/sa/sa2 -A

This is the output of files from a working server, as it should look:

-rw-r--r-- 1 root root 714305 Aug  1 23:53 sar01
-rw-r--r-- 1 root root 784968 Aug  1 23:55 sa01
-rw-r--r-- 1 root root 703111 Aug  2 23:53 sar02
-rw-r--r-- 1 root root 785016 Aug  2 23:55 sa02
-rw-r--r-- 1 root root 685031 Aug  3 23:53 sar03
-rw-r--r-- 1 root root 761928 Aug  3 23:55 sa03
-rw-r--r-- 1 root root 711740 Aug  4 22:20 sa04

This is the output from the problem server (these files are also miniscule with no info):

-rw-r--r-- 1 root root 552 Dec  7  2020 sa07
-rw-r--r-- 1 root root 504 Dec 21  2020 sa21
-rw-r--r-- 1 root root 504 Oct 20  2021 sa20
-rw-r--r-- 1 root root 504 Jul 14 21:11 sa14
-rw-r--r-- 1 root root 504 Jul 26 20:53 sa26
-rw-r--r-- 1 root root 504 Aug  4 22:04 sa04

I have also tried stopping/starting sysstat and killing the pid for /usr/local/netsnmp/netsnmp_base/sbin/snmpd. Nothing seems to be working. Any help would be greatly apprecaited!

I would like to track total CPU and memory use on an Ubuntu 20.04 machine. For that purpose, I am about to install the sysstat library. I read the manuals of and posts on sar and related functions, but am still confused about the syntax. **What I would like to do**: Record total CPU and memory use every five seconds. Export the data once a day as CSV and delete the binary data. **What confuses me**: 1. There are multiple settings specifying time intervals. sar -u %system -r %memused 5 records CPU and memory use every five seconds. On top of that, the package generates "activity reports" every ten minutes as defined by 5-55/10 * * * * root command -v debian-sa1 > /dev/null && debian-sa1 1 1 in /etc/cron.d/sysstat. I am confused about what happens every five seconds and what happens every ten minutes. Does the program first cache the data every five seconds and then writes it to a file every ten minutes? 2. Multiple functions write to disk. Which of them do I need? sar -u %system -r %memused -o 5, sadc -u %system -r %memused 5 -, or sa1? 3. Do I need to execute the code that generates a daily CSV file (sadf -d /var/log/sysstat/sa$(date +%d -d yesterday) > /home/some_user/sar_data.csv) as a chron job? As a side note: if anyone knows of a solution that would be computationally more efficient than this sysstat approach, feel free to suggest it.

I was trying the below entries to get the sar information for every 5 minutes including the 00:00:00 (midnight) data. 0 * * * * root /usr/lib64/sa/sa1 300 6 */5 1-22 * * * root /usr/lib64/sa/sa1 1 1 0,5,10,15,20,25,30,35,40,45,50,55 23 * * * root /usr/lib64/sa/sa1 1 1 55 23 * * * root /usr/lib64/sa/sa1 300 2 5,10,15,20,25,30,35,40,45,50,55 0 * * * root /usr/lib64/sa/sa1 1 1 But the above command adds the midnight data at end of the previous daily data file. I want to get the reading of 00:00:00 midnight entry in the same day file.

I've been monitoring my system using sar. I recently came across some interesting data: These are the stats for one of my Calico network devices... it seems to spike between ~0.2 Gbps and 20 Gpbs. The spikes are huge. We use these devices for Docker container networking.

12:00:01 AM     IFACE   rxpck/s   txpck/s    rxkB/s    txkB/s   rxcmp/s   txcmp/s  rxmcst/s
06:30:01 AM cali3bdaf00a84e 140696.72 150995.79  14960.45 2318047.28      0.00      0.00      0.00
06:40:01 AM cali3bdaf00a84e   1151.92   1264.66     81.12  21359.03      0.00      0.00      0.00
06:50:01 AM cali3bdaf00a84e 142858.42 153379.32  15114.04 2359706.82      0.00      0.00      0.00
07:00:01 AM cali3bdaf00a84e   1050.13   1162.73    136.67  20572.62      0.00      0.00      0.00
07:10:01 AM cali3bdaf00a84e 144932.62 155685.65  15322.14 2400295.98      0.00      0.00      0.00
07:20:01 AM cali3bdaf00a84e   1139.16   1251.25     80.36  20570.52      0.00      0.00      0.00

Same for my eth0 device, it spikes up to ~75 Gbps

12:00:01 AM     IFACE   rxpck/s   txpck/s    rxkB/s    txkB/s   rxcmp/s   txcmp/s  rxmcst/s
06:30:01 AM      eth0 10379825.81 5627209.54 10868448.25 8197353.75      0.00      0.00      0.00
06:40:01 AM      eth0  30695.55  14409.05  30708.83  27764.83      0.00      0.00      0.00
06:50:01 AM      eth0 10437914.98 5649581.74 10928787.81 8240375.35      0.00      0.00      0.00
07:00:01 AM      eth0  31251.21  15185.05  32729.30   8387.41      0.00      0.00      0.00
07:10:01 AM      eth0 10497803.58 5682599.52 10989315.11 8261565.31      0.00      0.00      0.00
07:20:01 AM      eth0  30306.80  16156.03  29500.73  11821.10      0.00      0.00      0.00

These numbers don't agree with the GCP App Engine network monitoring in the GCP UI that shows a maximum of 100MB/s or so. **Are the sar network metrics that it reports accurate?** **What could cause this tool to report different metrics than the GCP network monitoring tool?**

on our rhel Linux server we do the following in order to get info from sar command but we get sar Cannot open /var/log/sa/sa31: No such file or directory but we can see that only the following folders are exsist ls /var/log/sa/ sa01 sa04 sa07 sa10 sa13 sa16 sa19 sa22 sa25 sa28 sar01 sar04 sar07 sar10 sar13 sar16 sar19 sar22 sar25 sar28 sa02 sa05 sa08 sa11 sa14 sa17 sa20 sa23 sa26 sa29 sar02 sar05 sar08 sar11 sar14 sar17 sar20 sar23 sar26 sar29 sa03 sa06 sa09 sa12 sa15 sa18 sa21 sa24 sa27 sa30 sar03 sar06 sar09 sar12 sar15 sar18 sar21 sar24 sar27 sar30 so why sar command complain about sar31? how to avoid this problem ?

I'm running into a problem when using sar to collect live system statistics. When I run a sar command such as the following, I get the right output: $ sar -r 1 -o /tmp/memory_usage Linux 4.15.0-70-generic () 29/12/20 _x86_64_ (60 CPU) 18:26:55 kbmemfree kbavail kbmemused %memused kbbuffers kbcached kbcommit %commit kbactive kbinact kbdirty 18:26:56 30855140 78554416 51599624 62.58 321400 48906356 3491612 4.18 25558204 23859156 36 18:26:57 30855124 78554456 51599640 62.58 321400 48906392 3491612 4.18 25558204 23859212 72 18:26:58 30855204 78554536 51599560 62.58 321400 48906424 3491612 4.18 25558204 23859212 104 18:26:59 30855188 78554576 51599576 62.58 321400 48906456 3491612 4.18 25558204 23859268 136 18:27:00 30855204 78554648 51599560 62.58 321400 48906492 3491612 4.18 25558204 23859324 172 18:27:01 30855048 78554492 51599716 62.58 321400 48906524 3491612 4.18 25558228 23859324 0 ^C Average: 30855151 78554521 51599613 62.58 321400 48906441 3491612 4.18 25558208 23859249 87 However, when I load the output file, it seems to have only recorded the cpu usage? $ sar -f /tmp/memory_usage Linux 4.15.0-70-generic () 29/12/20 _x86_64_ (60 CPU) 18:26:55 CPU %user %nice %system %iowait %steal %idle 18:26:56 all 0.00 0.00 0.02 0.00 0.02 99.97 18:26:57 all 0.00 0.00 0.02 0.00 0.02 99.97 18:26:58 all 0.00 0.00 0.02 0.00 0.02 99.97 18:26:59 all 0.00 0.00 0.02 0.00 0.02 99.97 18:27:00 all 0.00 0.00 0.00 0.00 0.00 100.00 18:27:01 all 0.02 0.00 0.02 0.00 0.02 99.95 Average: all 0.00 0.00 0.01 0.00 0.01 99.97 This is my system's info: $ uname -a Linux 4.15.0-70-generic #79-Ubuntu SMP Tue Nov 12 10:36:11 UTC 2019 x86_64 x86_64 x86_64 GNU/Linux I'm running sar 11.6.1, which was installed through apt, and I did not configure any cron data collection (if that matters), although I did enable the sysstat service: $ systemctl status sysstat ● sysstat.service - Resets System Activity Data Collector Loaded: loaded (/lib/systemd/system/sysstat.service; enabled; vendor preset: enabled) Active: active (exited) since Tue 2020-12-29 16:56:29 GMT; 1h 34min ago Docs: man:sa1(8) man:sadc(8) man:sar(1) Process: 52376 ExecStart=/usr/lib/sysstat/debian-sa1 --boot (code=exited, status=0/SUCCESS) Main PID: 52376 (code=exited, status=0/SUCCESS) Dec 29 16:56:29 systemd: Starting Resets System Activity Data Collector... Dec 29 16:56:29 systemd: Started Resets System Activity Data Collector. Any idea what I'm doing wrong? Why is the memory usage not being recorded in the file? Did I misconfigure something, or is this not possible to achieve with sar? Any and all help would be greatly appreciated.

I know how to collect and make use of the data gathered by the sar tool, but I don't know how to interpret it correctly. For example, PAGING: I can see that my pgpin is 300.000 but how can I tell if that is good or bad, and what is the maximum _possible_ value of pgpin (not max(pgin))? Same with other values, IO: BREAD 1 million ... but what is the upper limit? If someone could hint me in the right direction that would be great. Thanks

Is there a way to just display a given days averages using sar. I currently do something like the following: sar -u -s 00:00:00 -e 23:59:59 -f /var/log/sysstat/sa10 And just take the last (average) line to add to a report. But it would be nice and easy to just gen my report if I could pass an argument to just spit-out the average. I could not find such an option in the sar documentation. So, unless I am missing it, I am guessing the option is no. However, It's very possible I'm missing it or there might be another tool other than sar that might expose this functionality.

What is the relation between %UTIL VS %WA in sar ? %util Percentage of CPU time during which I/O requests were issued to the device (bandwidth utilization for the device). Device saturation occurs when this value is close to 100%. %iowait (in Sar)

I have checked the sar report and found that CPU & Memory is getting utilized much more at particular time (for ex. day ago). Is it possible to find which process was taking much CPU & Mem? How do we found which process were consuming that Memory & CPU.

I am stuck on an IOwait related problem, the server I am monitoring shows a very high value for IOwait during my load run time **(50%-70%)**. I generated this data using the SAR report command. The ideal value should be below **8%-9%** as the server has **12 cores(1/12 ~ 0.08)**. I read this somewhere and took the assumption accordingly. What can be done to rectify this high IOwait problem, how is it related to other factors in the server which can be checked for to improve the performance.

we have Linux machine with 2 disks - sda and sdb ( sda is the OS ) lsblk -d -e 11,1 NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINT fd0 2:0 1 4K 0 disk sda 8:0 0 150G 0 disk sdb 8:16 0 70G 0 disk /GHT when we do sar -d , we get 12:00:01 AM DEV tps rd_sec/s wr_sec/s avgrq-sz avgqu-sz await svctm %util 12:10:01 AM dev8-16 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 12:10:01 AM dev8-0 0.12 0.07 1.93 16.87 0.00 0.48 0.28 0.00 12:10:01 AM dev253-0 0.01 0.07 0.04 8.00 0.00 0.38 0.37 0.00 12:10:01 AM dev253-1 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 12:10:01 AM dev253-2 0.12 0.00 1.89 15.53 0.00 0.51 0.23 0.00 12:20:01 AM dev8-16 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 we can see that DEV devices not displayed as sda or sdb ( disks ) so how to know which is sda or sdb ? is it possible in some way to use sar, and displayed the real disks - sda or sdb?