Once the servers have created & have been deployed to development or production etc, main task of system admin is to make sure that servers keep running by continuously monitoring its resource usage like memory utilization, CPU utilization etc with the help of various utilities. One such utility that is used for monitoring RHEL/CentOS servers is, SAR.

SAR or System Activity Report is used for monitoring Linux system resources . It can be used to generate reports relating to performance of a system i.e CPU reports, Memory reports, Disk reports etc. It saves reports in the form of log files on the system.

(Recommended Read: Installing Awstat for analyzing Apache logs)

(Also Read: Install Logrotate in Linux (CentOS, RHEL, Fedora, Ubuntu, Debian) )

In this tutorial, we are learn about monitoring system resources using SAR with the help of some examples but first we will install SAR on our system.

Monitoring Linux system resources using SAR


To install SAR utility on the system, ‘SYSSTAT’ package is required. To install sysstat , run

$ yum install sysstat

Now start & enable the sysstat service to start using SAR,

$ systemctl start sysstat
$ systemctl enable sysstat

Once the service is active, logs for the current day will be created in “/var/log/sa” folder in the file “sa15”, where 15 is the current date. Files for the older dates will be archived . We can also change the number of days for which we keep our files by changing the “HISTORY” parameter in the sysstat configuration file i.e. “/etc/sysconfig/sysstat”.

Syntax for SAR utility

Syntax for using sar is ,

$ sar option interval(in seconds) number of records

An example would be

$ sar 2 5

Here , sar will give report generated 2 seconds apart with total 5 records.


Examples of SAR

Generating CPU report of the CPUs

The sar command to generate CPU report for the CPUs on the system is,

$ sar -u 2 5

Generating Memory report

Option used with sar for generating the memory report is ‘-r’,

$ sar -r 2 5

Generating Block device statistics

Option to create block device report is ‘-d’ & its used with ‘-p’ to make the report into a pretty readable format,

$ sar -d -p 2 5

Generating SWAP report

Option to create SWAp memory report for the system is ‘-S’,

$ sar S 2 5

Generation i/O activity of the system

To check the I/O activity of the whole system, option used with sar is ‘-b’

$ sar -b 2 5

To view network statistics

To check the network stats of the system, option in ‘-n’ but it used with a keyword or we can use ‘ALL’ in place of a particular keyword to view all the network stats.

$ sar –n ‘Keyword’ (or ‘ALL’)

Keywords can be, DEV – For network interface statistics,

EDEV – Display network device failure statistics

IP – For IPv4 network traffic

EIP – For IPv4 network errors

ICMP – For ICMPv4 network traffic

EICMP – For ICMPv4 network errors

TCP – For TCPv4 network traffic

ETCP – For TCPv4 network errors

UDP – For UDPv4 network traffic

NFS – For NFS client activities

NFSD – For NFS server activities

SOCK – For sockets in use for IPv4

SOCK6, IP6, EIP6, ICMP6, UDP6 are for IPv6

Note: When using ‘ALL’ as a parameter, reports generated can be very long.

Saving output of sar to a file

We can also save the output of any sar command to a file using the options ‘-o’,

$ sar –r 2 4 –o /home/log

Where, /home/log is the location of file.

These were some the examples that are used for Monitoring Linux system resources using SAR . For queries/questions, please use the comment box below.


If you think we have helped you or just want to support us, please consider these :-

Connect to us: Facebook | Twitter

Linux TechLab is thankful for your continued support.