sar is a tool to collect, report, or save system activity information. Thus this can not only help to identify the current metrics but also can dig up old data for analysis. sar is the most commonly used tool for performance troubleshooting and capacity planning in the Linux server environment.

sar tool can be made available by installing sysstat package on the system. sar by default logs all system reports under /var/log/sa/. By default, the log files are date-stamped with the current day of the month, so the logs will rotate automatically and overwrite previous month’s logs.

sar usage

#usage
#sar [flags][interval][count]
#Below sar command outputs system usage data five times with an interval of 2 seconds between each output. 
#Not specifying any flags selects only CPU activity
sar 2 5

Linux 2.6.32-358.el6.x86_64 (unixutils)        05/29/2018      _x86_64_        (1 CPU)

05:53:57 AM     CPU     %user     %nice   %system   %iowait    %steal     %idle
05:53:59 AM     all      0.50      0.00      1.01      0.00      0.00     98.49
05:54:01 AM     all      2.51      0.00      2.01      2.01      0.00     93.47
05:54:03 AM     all      1.50      0.00      1.50      0.00      0.00     97.00
05:54:05 AM     all      1.49      0.00      1.00      0.00      0.00     97.51
05:54:07 AM     all      1.52      0.00      1.01      0.00      0.00     97.47
Average:        all      1.50      0.00      1.30      0.40      0.00     96.79

sar report for past date
sar can dig up system data for a day from the past as well.

#sar [-f specify the file]
#piping head to limit first 10 lines.
#sar data for the 26th day of the month.
sar -f /var/log/sa/sa26 | head

Linux 2.6.32-358.el6.x86_64 (unixutils)        05/26/2018      _x86_64_        (1 CPU)

12:00:01 AM     CPU     %user     %nice   %system   %iowait    %steal     %idle
12:10:01 AM     all      1.82      0.00      1.18      0.93      0.00     96.06
12:20:01 AM     all      1.40      0.00      1.06      0.45      0.00     97.09
12:30:01 AM     all      1.62      0.00      1.13      0.27      0.00     96.97
12:40:01 AM     all      2.26      0.00      1.22      0.69      0.00     95.83
12:50:01 AM     all      1.80      0.00      1.29      0.92      0.00     95.99
01:00:01 AM     all      1.50      0.00      1.15      0.81      0.00     96.54
01:10:01 AM     all      1.44      0.00      1.11      1.75      0.00     95.70

sar outputs can also be filtered for a specific time range, when displaying data from the past.

sar report for a specific time range

# sar -f /var/log/sa/sa[day] -s [ hh:mm:ss ] ] [ -e [ hh:mm:ss ]
sar -f /var/log/sa/sa26 -s 13:00:00 -e 14:30:00

Linux 2.6.32-358.el6.x86_64 (unixutils)        05/26/2018      _x86_64_        (1 CPU)

01:00:01 PM     CPU     %user     %nice   %system   %iowait    %steal     %idle
01:10:01 PM     all      1.59      0.00      1.21      0.18      0.00     97.02
01:20:01 PM     all      1.89      0.00      1.34      0.41      0.00     96.35
01:30:01 PM     all      1.34      0.00      1.15      0.17      0.00     97.35
01:40:02 PM     all      2.69      0.00      1.39      0.19      0.00     95.73
01:50:01 PM     all      1.53      0.00      1.25      0.17      0.00     97.05
02:00:02 PM     all      1.37      0.00      1.15      0.20      0.00     97.27
02:10:01 PM     all      1.88      0.00      1.28      0.19      0.00     96.65
02:20:01 PM     all      1.47      0.00      1.16      0.30      0.00     97.07
Average:        all      1.72      0.00      1.24      0.23      0.00     96.81

The above output shows CPU reports from between 1.00 PM to 2.30 PM on 05/26/2018. Note that the data is recorded for every 10 minutes, which is default. Also, the above two outputs show only CPU activity, since no flags were specified.

Below are different options that can be passed to sar to filter and display different types of reports.

CPU

#CPU Usage
sar -P ALL

Memory
#Memory Usage
sar -r

SWAP
 
#Swap Usage
sar -S

I/O
 
#I/O
sar -b

I/O by block device
 
#I/O by Block Device
sar -d -p [device_name]

Load Average & Run queue
#Run Queue and Load Average
sar -q

Network
 
#Network Stats
sar -n DEV