Some more command to use SAR command for system monitoring

The main thing that we need to understand regarding SAR is that, everything is done using a cron. By default in many Linux distribution you will have a file named /etc/cron.d/sysstat. Some more command to use SAR command for system monitoring:

Individual Block Device I/O Activities

To identify the activities by the individual block devices use following command.

# sar -d 1 1

Output:

Linux 2.6.32-504.1.3.el6.x86_64 (node.techoism.com)    06/18/2015      _x86_64_        (4 CPU)

01:29:29 PM       DEV       tps  rd_sec/s  wr_sec/s  avgrq-sz  avgqu-sz     await     svctm     %util
01:29:30 PM    dev8-0      0.00      0.00      0.00      0.00      0.00      0.00      0.00      0.00
01:29:30 PM   dev8-16      0.00      0.00      0.00      0.00      0.00      0.00      0.00      0.00
01:29:30 PM    dev9-2      0.00      0.00      0.00      0.00      0.00      0.00      0.00      0.00
01:29:30 PM    dev9-0      0.00      0.00      0.00      0.00      0.00      0.00      0.00      0.00
01:29:30 PM    dev9-1      0.00      0.00      0.00      0.00      0.00      0.00      0.00      0.00

Average:          DEV       tps  rd_sec/s  wr_sec/s  avgrq-sz  avgqu-sz     await     svctm     %util
Average:       dev8-0      0.00      0.00      0.00      0.00      0.00      0.00      0.00      0.00
Average:      dev8-16      0.00      0.00      0.00      0.00      0.00      0.00      0.00      0.00
Average:       dev9-2      0.00      0.00      0.00      0.00      0.00      0.00      0.00      0.00
Average:       dev9-0      0.00      0.00      0.00      0.00      0.00      0.00      0.00      0.00
Average:       dev9-1      0.00      0.00      0.00      0.00      0.00      0.00      0.00      0.00

Understanding the output of SAR command

• DEV: Its indicates the specific block device. dev8-0 means a block device with 8 as major number, and 0 as minor number
• tps: Indicate the number of transfers per second.
• rd_sec/s: Number of sectors read from the device.
• wr_sec/s: Number of sectors written to the device.
• avgrq-sz: The normal size (in sector) of the requests that were issued to the device.
• avgqu-sz: The average queue length of the requests that were issued to the device.
• await: The average time (in milliseconds) for I/O requests issued to the device to be wait.
• svctm: The average service time (in milliseconds) for I/O requests that were issued to the device..
• %util: Percentage of CPU time during which I/O requests were issued to the device.

Taking after are few of varieties:

• sar -d
• sar -p -d 1 1
• sar -d 1 3
• sar -d -f /var/log/sa/sa10
• sar -p -d

Display context switch per second

This reports the aggregate number of processes created every second, and aggregate number of setting switches every second.

# sar -w 1 3

Output:

Linux 2.6.32-504.1.3.el6.x86_64 (node.techoism.com)    06/18/2015      _x86_64_        (4 CPU)

02:58:15 PM    proc/s   cswch/s
02:58:16 PM      1.00    451.00
02:58:17 PM      0.00    411.11
02:58:18 PM      1.00    506.00
02:58:19 PM      0.00    609.00
Average:         0.50    494.49

Understanding the output of SAR command

• proc/s: Total number of tasks created per second.
• cswch/s: Total number of context switches per second.

Taking after are few of varieties:

• sar -w
• sar -w 1 3
• sar -w -f /var/log/sa/sa10

Reports run queue and load average

This reports the run queue size and load average. Use following command to check,

# sar -q 1 2

Output:

Linux 2.6.32-504.1.3.el6.x86_64 (node.techoism.com)    06/18/2015      _x86_64_        (4 CPU)

03:02:14 PM   runq-sz  plist-sz   ldavg-1   ldavg-5  ldavg-15
03:02:15 PM         0       429      0.17      0.38      0.55
03:02:16 PM         0       429      0.17      0.38      0.55
Average:            0       429      0.17      0.38      0.55

Understanding the output of SAR command

• runq-sz: Run queue length.
• plist-sz: Number of tasks in the task list.
• ldavg-1: System load average for the last minute.
• ldavg-5: System load average for the past 5 minute.
• ldavg-15: System load average for the past 15 minute.

Taking after are few of varieties:

• sar -q
• sar -q 1 3
• sar -q -f /var/log/sa/sa10

Report network statistics

This reports different system measurements. For instance: number of packets got transmitted through the network card, statistics of packet failure etc.

sar -n KEYWORD

KEYWORD can be one of the following:

• DEV: Displays network devices vital statistics for eth0, eth1, etc.,
• EDEV: Display network device failure statistics
• NFS: Displays NFS client activities
• NFSD: Displays NFS server activities
• SOCK: Displays sockets in use for IPv4
• IP: Displays IPv4 network traffic
• EIP: Displays IPv4 network errors
• ICMP: Displays ICMPv4 network traffic
• EICMP: Displays ICMPv4 network errors
• TCP: Displays TCPv4 network traffic
• ETCP: Displays TCPv4 network errors
• UDP: Displays UDPv4 network traffic
• SOCK6, IP6, EIP6, ICMP6, UDP6 are for IPv6
• ALL: This displays all of the above information. The output will be very long.

# sar -n DEV 1 1

Output:

Linux 2.6.32-504.1.3.el6.x86_64 (node.techosim.com)    06/18/2015      _x86_64_        (4 CPU)

03:12:43 PM     IFACE   rxpck/s   txpck/s    rxkB/s    txkB/s   rxcmp/s   txcmp/s  rxmcst/s
03:12:44 PM        lo      0.00      0.00      0.00      0.00      0.00      0.00      0.00
03:12:44 PM      eth0     41.00     23.00     57.88      1.66      0.00      0.00      4.00
03:12:44 PM      eth1      0.00      0.00      0.00      0.00      0.00      0.00      0.00

Average:        IFACE   rxpck/s   txpck/s    rxkB/s    txkB/s   rxcmp/s   txcmp/s  rxmcst/s
Average:           lo      0.00      0.00      0.00      0.00      0.00      0.00      0.00
Average:         eth0     41.00     23.00     57.88      1.66      0.00      0.00      4.00
Average:         eth1      0.00      0.00      0.00      0.00      0.00      0.00      0.00

Report SAR Data Using Start Time

When you see historic sar information from the /var/log/sa/saXX file using “sar -f” option, it shows all the sar information for that particular day beginning from 12:00 a.m for that day.

Using “-s hh:mi:ss” option, you can determine the begin time. Case in point, in the event that you indicate “sar -s 02:00:00″, it will show the sar information beginning from 02 AM as shown below:

# sar -q -f /var/log/sa/sa17 -s 02:10:01

Output:

Linux 2.6.32-504.1.3.el6.x86_64 (node.techoism.com)    06/17/2015      _x86_64_        (4 CPU)

02:10:02 AM   runq-sz  plist-sz   ldavg-1   ldavg-5  ldavg-15
02:20:01 AM        11       402      0.22      0.47      0.58
02:30:01 AM        11       399      0.30      0.57      0.61
02:40:01 AM        13       402      0.21      0.45      0.54
02:50:01 AM        11       399      0.19      0.45      0.51
03:00:01 AM        12       406      0.59      0.53      0.49
...

If you want to see the report of any particular time then we can do it using following command:

# sar -q -f /var/log/sa/sa17 -s 02:10:01 -e 03:20:01 

Output:

Linux 2.6.32-504.1.3.el6.x86_64 (node.techosim.com)    06/17/2015      _x86_64_        (4 CPU)

02:10:02 AM   runq-sz  plist-sz   ldavg-1   ldavg-5  ldavg-15
02:20:01 AM        11       402      0.22      0.47      0.58
02:30:01 AM        11       399      0.30      0.57      0.61
02:40:01 AM        13       402      0.21      0.45      0.54
02:50:01 AM        11       399      0.19      0.45      0.51
03:00:01 AM        12       406      0.59      0.53      0.49
03:10:01 AM        11       404      0.16      0.42      0.48
03:20:01 AM        11       406      0.14      0.34      0.44
Average:           11       403      0.26      0.46      0.52

Reference Articles:
How to install and configure SAR on CentOS/RHEL
How of use SAR command for system monitoring in CentOS/RHEL