sarCollect and replay system activity history
sar (System Activity Reporter, part of sysstat) reports CPU, memory, disk, network and load, either live every few seconds or from history files recorded every 10 minutes. It answers the question other tools can't: what was this box doing at 02:10 last night?
sar [-u|-r|-q|-b|-d -p|-n DEV|-W|-A] [-f FILE] [-s HH:MM:SS] [-e HH:MM:SS] [INTERVAL [COUNT]]Users report slowness right now and you want a quick per-second view of CPU, memory and load in one tool.
sarReads activity data, live or from a daily binary file, and prints it as a time table.
sar is the report half of sysstat. The collector, sadc, reads kernel counters from /proc: /proc/stat for CPU, /proc/meminfo, /proc/loadavg, /proc/diskstats, /proc/net/dev, /proc/vmstat. Counters only ever increase, so a rate is the difference between two samples divided by the interval. In live mode (sar -u 1 3) sar starts sadc itself and prints each interval. For history, a systemd timer (sysstat-collect.timer, every 10 minutes) runs sa1, which appends a sample to a binary file per day: /var/log/sysstat/saDD on Ubuntu, /var/log/sa/saDD on RHEL and Amazon Linux. Another timer runs sa2 after midnight to write a text summary. Files are kept for HISTORY days (7 by default on Ubuntu). On Ubuntu collection is off until you set ENABLED="true" in /etc/default/sysstat. The 10-minute averages hide short spikes, so use live mode with a 1-second interval while an incident is happening.
-uCPU: %user %nice %system %iowait %steal %idle (-P ALL per core)-rMemory: free, available, used, buffers, cached, committed, dirty-qRun queue length, process count, load averages, blocked tasks-bTotal I/O transfers and blocks read/written per second-d -pPer-disk tps, kB/s, await (ms) and %util, with device names-n DEV / EDEVPer-interface packets and kB/s / interface errors and drops-n TCP,ETCPTCP connections opened per second, retransmits, resets-WSwapping: pages swapped in and out per second-f FILERead a history file instead of live data-s / -eStart / end time when reading historyINTERVAL COUNTLive mode: sample every INTERVAL seconds, COUNT timesInstalling sysstat on Ubuntu and assuming history is being recordedUbuntu ships it with ENABLED="false"; nothing is collected until you change it, so there's no data when you need it.
Set ENABLED="true" in /etc/default/sysstat and systemctl enable --now sysstat on every server imageReading only the Average line of a history reportAn average over an hour flattens a 20-minute spike into a mild bump.
Look at the individual rows, and narrow the window with -s and -eExpecting sar history to catch a 30-second spikeHistory is sampled every 10 minutes and averaged; short bursts disappear.
During an incident use live mode: sar -u 1 60, or a monitoring agent with 10-60 s resolutionLooking for sa files in /var/log/sa on Ubuntu (or /var/log/sysstat on RHEL)The path differs by distribution, so you conclude there's no data.
Ubuntu/Debian: /var/log/sysstat/saDD; RHEL, Amazon Linux: /var/log/sa/saDDTry these on a Linux machine of your own. Each task has a hint and a solution.
Show CPU usage every 2 seconds, 5 times, then the average.
Show memory and swap activity live, 3 samples one second apart.
Check whether history collection is enabled on this machine, and list the history files if any.
sarCollect and replay system activity history
sar (System Activity Reporter, part of sysstat) reports CPU, memory, disk, network and load, either live every few seconds or from history files recorded every 10 minutes. It answers the question other tools can't: what was this box doing at 02:10 last night?
sar [-u|-r|-q|-b|-d -p|-n DEV|-W|-A] [-f FILE] [-s HH:MM:SS] [-e HH:MM:SS] [INTERVAL [COUNT]]Users report slowness right now and you want a quick per-second view of CPU, memory and load in one tool.
sarReads activity data, live or from a daily binary file, and prints it as a time table.
sar is the report half of sysstat. The collector, sadc, reads kernel counters from /proc: /proc/stat for CPU, /proc/meminfo, /proc/loadavg, /proc/diskstats, /proc/net/dev, /proc/vmstat. Counters only ever increase, so a rate is the difference between two samples divided by the interval. In live mode (sar -u 1 3) sar starts sadc itself and prints each interval. For history, a systemd timer (sysstat-collect.timer, every 10 minutes) runs sa1, which appends a sample to a binary file per day: /var/log/sysstat/saDD on Ubuntu, /var/log/sa/saDD on RHEL and Amazon Linux. Another timer runs sa2 after midnight to write a text summary. Files are kept for HISTORY days (7 by default on Ubuntu). On Ubuntu collection is off until you set ENABLED="true" in /etc/default/sysstat. The 10-minute averages hide short spikes, so use live mode with a 1-second interval while an incident is happening.
-uCPU: %user %nice %system %iowait %steal %idle (-P ALL per core)-rMemory: free, available, used, buffers, cached, committed, dirty-qRun queue length, process count, load averages, blocked tasks-bTotal I/O transfers and blocks read/written per second-d -pPer-disk tps, kB/s, await (ms) and %util, with device names-n DEV / EDEVPer-interface packets and kB/s / interface errors and drops-n TCP,ETCPTCP connections opened per second, retransmits, resets-WSwapping: pages swapped in and out per second-f FILERead a history file instead of live data-s / -eStart / end time when reading historyINTERVAL COUNTLive mode: sample every INTERVAL seconds, COUNT timesInstalling sysstat on Ubuntu and assuming history is being recordedUbuntu ships it with ENABLED="false"; nothing is collected until you change it, so there's no data when you need it.
Set ENABLED="true" in /etc/default/sysstat and systemctl enable --now sysstat on every server imageReading only the Average line of a history reportAn average over an hour flattens a 20-minute spike into a mild bump.
Look at the individual rows, and narrow the window with -s and -eExpecting sar history to catch a 30-second spikeHistory is sampled every 10 minutes and averaged; short bursts disappear.
During an incident use live mode: sar -u 1 60, or a monitoring agent with 10-60 s resolutionLooking for sa files in /var/log/sa on Ubuntu (or /var/log/sysstat on RHEL)The path differs by distribution, so you conclude there's no data.
Ubuntu/Debian: /var/log/sysstat/saDD; RHEL, Amazon Linux: /var/log/sa/saDDTry these on a Linux machine of your own. Each task has a hint and a solution.
Show CPU usage every 2 seconds, 5 times, then the average.
Show memory and swap activity live, 3 samples one second apart.
Check whether history collection is enabled on this machine, and list the history files if any.