How to Use the sar command Monitoring System in CentOS

How to Use the sar command Monitoring System in CentOS
This article mainly introduces how to use the sar command Monitoring System in Linux. It is the basic knowledge of Linux. For more information, see

Sar (System Activity Reporter System Activity Report) is one of the most comprehensive System performance analysis tools on Linux. It can report System activities from multiple parties,
Including: file read/write, system call usage, disk I/O, CPU efficiency, memory usage, process activity and IPC-related activities.
This document describes the sar commands in CentOS 6.3 x64.
1. Common formats of sar commands
Sar [options] [-A] [-o file] t [n]
Where:
T indicates the sampling interval, and n indicates the number of samples. The default value is 1;
-O file: stores the command results in binary format. file is the file name.
Options is the command line option. Common options for sar commands are as follows:

-A: total of all reports
-P: Set the CPU
-U: outputs CPU usage statistics
-V: outputs statistics of inode, files, and other kernel tables.
-D: outputs the activity information of each block device.
-N: Report Network Conditions
-Q: Report queue length and load information
-R: Output memory and swap space statistics
-B: displays the I/O and transfer rate statistics.
-A: file read/write status
-C: output process statistics, number of processes created per second
-R: Output Memory Page statistics
-Y: terminal device activity
-W: Output System exchange activity information
2. CPU resource monitoring
For example, sample once every 10 seconds, sample three times in a row, observe the CPU usage, and save the sample result in binary format to the file sys_info in the current directory. Enter the following command:

Sar-u-o sys_info 10 3

The screen is shown as follows:
17:06:16 CPU % user % nice % system % iowait % steal % idle
17:06:26 all 0.00 0.00 0.20 0.00 0.00
17:06:36 all 0.00 0.00 0.20 0.00 0.00
17:06:46 all 0.00 0.00 0.10 0.00 0.00
Average: all 0.00 0.00 0.17 0.00 0.00
Output description:
CPU: all indicates that the statistical information is the average value of all CPUs.
% User: displays the percentage of total CPU usage at the user level (application.
% Nice: displays the percentage of the total CPU usage for nice operations at the user level.
% System: Percentage of total CPU usage at the core level (kernel.
% Iowait: displays the percentage of CPU usage for I/O operations.
% Steal: the percentage of virtual CPUs waiting for hypervisor to provide services for another virtual process.
% Idle: displays the percentage of CPU consumed by idle time.
Note:
(1) If % iowait is too high, it indicates that the hard disk has an I/O bottleneck.
(2). If the value of % idle is high but the system response is slow, it may be that the CPU is waiting to allocate memory. In this case, increase the memory capacity.
(3) If the value of % idle is lower than 1, the CPU processing capability of the system is relatively low, indicating that the most important resource to be solved in the system is the CPU.
Because sys_info is the content in the binary file, it is garbled when you use cat to view sys_info. Don't worry, sar has prepared the-f filename option for you, you only need to use-f to set the information storage file to be read, and then you can clearly read the information.

For example

Sar-f sys_info

.

If my CPU is a multi-core processor, can sar know the running information of a certain core?
No problem at all. One option-P is designed for multi-core processors.
When the-P option is not set while using the sar command, the sar will give a macro report based on all cores, that is, the average value.
If the-P option is used to specify a single core, the specific performance information is provided for this separate core.
When-p all is used, sar will give its specific performance information based on each core, and then give a general performance information.

For example, I have a Xeon processor CPU, which is a dual-core CPU. Let's see how to use-P:

Sar-p all 1 1 1

Linux 2.6.9 10/16/2009

At 10:59:38 CPU % user % nice % system % iowait % idle
10:59:39 PM all 2.12 0.00 2.87 0.00 95.01
10:59:39 PM 0 0.00 0.00 1.98 0.00 98.02
10:59:39 PM 1 9.00 0.00 7.00 0.00
Sar will provide performance information based on each core of the processor. When we want to view the information of 6th cores, the output is as follows:

Sar-P 0 1 1

3. inode, file, and other kernel Table Monitoring
For example, if you sample the table every 10 seconds and sample the table three times in a row to observe the status of the core table, enter the following command:

Sar-v 10 3

The screen is shown as follows:
17:10:49 dentunusd file-nr inode-nr pty-nr
17:10:59 6301 5664 12037 4
17:11:09 6301 5664 12037 4
17:11:19 6301 5664 12037 4
Average: 6301 5664 12037 4
Output description:
Dentunusd: number of unused entries in the directory Cache
File-nr: the number of file handles used.
Inode-nr: inode handle
Pty-nr: Number of pty used
4. Memory and swap space monitoring
For example, sampling is performed once every 10 seconds, and sampling is performed three times in a row. Monitoring memory paging:

Sar-r 10 3

The screen is shown as follows:
10:02:52 kbmemfree kbmemused % memused kbbuffers kbcached kbcommit % commit
10:03:02 2289016 1632096 41.62 204860 1218352 333068
10:03:12 2288388 1632724 41.64 204860 1218352 333068
10:03:22 2288544 1632568 41.64 204860 1218352 333068
Average: 2288649 1632463 41.63 204860 1218352 333068

Output description:
Kbmemfree: this value is basically the same as the free value in the free command, so it does not include the buffer and cache space.
Kbmemused: this value is basically the same as the used value in the free command, so it includes the buffer and cache space.
% Memused: this value is a percentage of kbmemused and total memory (excluding swap.
Kbbuffers and kbcached: These two values are buffer and cache in the free command.
Kbcommit: Ensure the memory required by the current system, that is, the memory required to ensure no overflow (RAM + swap ).
% Commit: this value is a percentage of kbcommit and total memory (including swap.
5. Memory paging monitoring
For example, sampling is performed once every 10 seconds, and sampling is performed three times in a row. Monitoring memory paging:

Sar-B 10 3

The screen is shown as follows:

Output description:
Pgpgin/s: the number of bytes per second from disk or SWAP to memory (KB)
Pgpgout/s: the number of bytes per second from memory replacement to disk or SWAP (KB)
Fault/s: number of missing pages generated by the system per second, that is, the sum of the Primary and Secondary missing pages (major + minor)
Majflt/s: Number of Primary missing pages per second.
Pgfree/s: Number of pages per second in the idle queue
Pgscank/s: Number of pages scanned by kswapd per second
Pgscand/s: number of directly scanned pages per second
Pgsteal/s: the number of pages that are cleared from the cache every second to meet memory requirements
% Vmeff: Percentage of pages cleared per second (pgsteal) to total scanning pages (pgscank + pgscand)
6. I/O and Transfer Rate Monitoring
For example, if you sample data every 10 seconds and sample data three times in a row to report the usage of the buffer, you need to enter the following command:

Sar-B 10 3

The screen is shown as follows:
18:51:05 tps rtps wtps bread/s bwrtn/s
18:51:15 0.00 0.00 0.00 0.00 0.00
18:51:25 1.92 0.00 1.92 0.00 22.65
18:51:35 0.00 0.00 0.00 0.00 0.00
Average: 0.64 0.00 0.64 0.00 7.59
Output description:
Tps: the total amount of I/O transferred by physical devices per second
Rtps: Total amount of data read from physical devices per second
Wtps: Total amount of data written to the physical device per second
Bread/s: the amount of data read from the physical device per second. Unit: block/s.
Bwrtn/s: the volume of data written to the physical device per second. Unit: block/s.
7. Process queue length and average load Status Monitoring
For example, sample once every 10 seconds and sample three times in a row to monitor the length of the process queue and the average load status:

Sar-q 10 3

The screen is shown as follows:
19:25:50 runq-sz plist-sz ldavg-1 ldavg-5 ldavg-15
19:26:00 0 259 0.00 0.00 0.00
19:26:10 0 259 0.00 0.00 0.00
19:26:20 0 259 0.00 0.00 0.00
Average: 0 259 0.00 0.00
Output description:
Runq-sz: length of the running Queue (number of processes awaiting running)
Plist-sz: Number of processes and threads in the Process List
Ldavg-1: average System load for the last minute (System load average)
Ldavg-5: average system load for the past 5 minutes
Ldavg-15: average system load for the past 15 minutes
8. Monitoring of system exchange activity information
For example, if sampling is performed once every 10 seconds and three consecutive sampling times, the monitoring system will exchange activity information:

Sar-W 10 3

The screen is shown as follows:
19:39:50 pswpin/s pswpout/s
19:40:00 0.00 0.00
19:40:10 0.00 0.00
19:40:20 0.00 0.00
Average: 0.00 0.00
Output description:
Pswpin/s: Number of swap pages per second
Pswpout/s: Number of swap pages generated by the system per second
9. device usage monitoring
For example, if you want to sample the device every 10 seconds for three consecutive times and report the device usage, enter the following command:

# Sar-d 10 3-p

The screen is shown as follows:
17:45:54 DEV tps rd_sec/s wr_sec/s avgrq-sz avgqu-sz await svctm % util
0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00
17:46:04 sda 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00
17:46:04 vg_livedvd-lv_root 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00
17:46:04 vg_livedvd-lv_swap 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00
Where:
Parameter-p can print out the sda, hdc and other disk device names, if you do not have the parameter-p, the device node may be a dev8-0, dev22-0
Tps: the number of I/O requests from the physical disk per second. Multiple logical requests are merged into one I/O disk request. The size of one transmission is uncertain.
Rd_sec/s: Number of read sectors per second.
Wr_sec/s: Number of write sectors per second.
Avgrq-sz: average data size (slice) of each device I/O operation ).
Avgqu-sz: average length of the disk Request queue.
Await: Average time consumed by each request, from the request disk operation to the system processing, including the request queue waiting time, in milliseconds (1 second = 1000 milliseconds ).
Svctm: average time for the system to process each request, excluding the time consumed in the Request queue.
% Util: Percentage of I/O requests to CPU. The larger the ratio, the more saturated the request.
(1) When avgqu-sz is low, the utilization rate of the device is high.
(2) When % util is close to 100%, the bandwidth of the device is full.
10. To determine the system bottleneck, you may need to combine several sar command options.
Suspected CPU bottlenecks, which can be viewed by sar-u and sar-q.
Suspected memory bottlenecks, which can be viewed by sar-B, sar-r, and sar-W.
I/O bottlenecks are suspected, which can be viewed by sar-B, sar-u, and sar-d.

11. Using sar as a background monitoring program, you can report machine performance in real time. Can sar be run in the background?
You can use the linux background character. Don't forget to redirect the standard output. The method is as follows:

Sar-o monitor. res interval count>/dev/null 2> & 1 &

Remember to replace interval and count with the desired interval and number of times. In this way, all the performance information is stored in the binary data file monitor. res. Use-f for reading.

12. sar Analysis of NIC traffic

Sar-n {DEV | EDEV | NFS | NFSD | SOCK | ALL}

Sar provides six different syntax options to display network information. The-n option uses six different switches: DEV | EDEV | NFS | NFSD | SOCK | ALL. DEV displays network interface information, EDEV displays statistics on network errors, NFS statistics on active NFS clients, NFSD statistics on NFS servers, and SOCK displays socket information, ALL shows ALL 5 switches. They can be used independently or together.
If you use the DEV keyword, sar will report information related to network devices, such as lo, eth0, and eth1. For example

# Sar-n DEV 2 10

Linux 2.6.18-53. el5PAE (localhost. localdomain) 03/29/2009

01:39:40 am iface rxpck/s txpck/s rxbyt/s txbyt/s rxcmp/s txcmp/s rxmcst/s
01:39:42 AM lo 0.00 0.00 0.00 0.00 0.00 0.00 0.00
01:39:42 AM eth1 131.34 104.98 119704.48 36110.45 0.00 0.00 0.00
01:39:42 AM sit0 0.00 0.00 0.00 0.00 0.00 0.00 0.00

01:39:42 am iface rxpck/s txpck/s rxbyt/s txbyt/s rxcmp/s txcmp/s rxmcst/s
01:39:44 AM lo 0.00 0.00 0.00 0.00 0.00 0.00 0.00
01:39:44 AM eth1 168.00 165.50 114496.50 83938.50 0.00 0.00 0.00
01:39:44 AM sit0 0.00 0.00 0.00 0.00 0.00 0.00 0.00

IFACE: LAN interface, network device name
Rxpck/s: packets received per second
Txpck/s: Packets sent per second
Rxbyt/s: number of bytes received per second
Txbyt/s: number of bytes sent per second
Rxcmp/s: compressed data packets received per second
Txcmp/s: compressed data packets sent per second
Rxmcst/s: multicast packet received per second
When the EDEV keyword is used, the network device will report the failure, for example:

# Sar-n EDEV 2 10

Linux 2.6.18-53. el5PAE (localhost. localdomain) 03/29/2009
01:42:18 am iface rxerr/s txerr/s coll/s rxdrop/s txdrop/s txcarr/s rxfram/s rxfifo/s txfifo/s
01:42:20 AM lo 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00
01:42:20 AM eth1 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00
01:42:20 AM sit0 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00

IFACE: name of the LAN interface network device
Rxerr/s: bad packets received per second
Txerr/s: Bad packet sent per second
Coll/s: number of conflicts per second
Rxdrop/s: number of received packets discarded per second because the buffer is full
Txdrop/s: the number of sent packets discarded per second because the buffer is full
Txcarr/s: Number of carrier errors per second during packet sending
Rxfram/s: Number of frame alignment errors of packets received per second
Rxfifo/s
Txfifo/s
If the SOCK keyword is used, the socket connection will be reported:

# Sar-n SOCK 2 10

Linux 2.6.18-53. el5PAE (localhost. localdomain) 03/29/2009

01:44:32 AM totsck tcpsck udpsck rawsck ip-frag
01:44:34 AM 243 9 8 0 0
01:44:36 AM 242 9 7 0 0
01:44:38 AM 238 9 7 0 0
01:44:40 AM 238 9 7 0 0

Totsck: Total number of sockets used
Tcpsck: number of TCP sockets used
Udpsck: number of UDP sockets used
Rawsck: Number of raw sockets used
Ip-frag: number of IP segments used
If you use the FULL keyword, it is equivalent to the synthesis of DEV, EDEV, and SOCK.