Linux SAR Command detailed

The SAR (System Activity Reporter report) is one of the most comprehensive systems performance analysis tools available on Linux and can be used to report on the activities of the system in several ways, including: Read and write of files, usage of system calls, disk I/O, CPU efficiency , memory usage, activities, and IPC-related activities. The following mainly takes Redhat system as an example to introduce the SAR command.

Common formats for SAR commands

SAR [Options] [-A] [-o file] t [n]

which

T is the sampling interval, n is the number of samples, the default value is 1;

-o file means that the command result is stored in a binary format into a file, and file is a filename.

Options is the command-line option and the SAR command is commonly chosen as follows:

　　

-A: Sum of all reports

-U: Output statistics about CPU usage

-V: Output inode, File box other kernel table statistics

-D: Output activity information for each block device

-r: Output memory and swap space statistics

-B: Display statistics for I/O and transfer rates

-A: File read and write status

-C: Output statistics, number of processes created per second

-r: Output memory page statistics

-Y: terminal equipment activity situation

-W: Output system Exchange activity information

1. CPU Resource Monitoring

For example, sampling every 10 seconds, sampling 3 times in a row, observing CPU usage, and storing the sample results in binary form in the file test in the current directory, you need to type the following command:

Sar-u-O Test 10 3

The screen appears as follows:

　　

Output Item Description:

Cpu:all indicates that the statistic is the average of all CPUs;

%user: Displays the percentage of total CPU time that the user level (application) runs using;

%nice: The percentage of the total CPU time that is displayed at the user level for the nice operation;

%system: The percentage of total CPU time used at the core level (kernel) to run;

%iowait: Displays the percentage of the total CPU time that is used to wait for I/O operations;

%steal: The percentage of the hypervisor (hypervisor) waiting for a virtual CPU to serve another virtual server;

%idle: Shows the percentage of CPU idle time occupying the total CPU time;

1. If the%iowait value is too high, it indicates that the hard disk has an I/O bottleneck

2. If the value of the%idle is high but the system responds slowly, it is possible that the CPU waits for the allocated memory, at which time the memory capacity should be increased

3. If the value of%idle is consistently below 1, the system has a relatively low CPU capacity, indicating that the most necessary resource to be addressed in the system is the CPU.

If you want to view the contents of a binary file test, you would type the following SAR command:

Sar-u-F Test

2. Inode, file, and other kernel table monitoring

For example, sampling every 10 seconds, sampling 3 times in a row, observing the status of the kernel table, you need to type the following command:

Sar-v 10 3

The screen appears as follows:

　　

Output Item Description:

DENTUNUSD: Number of unused entries in the directory cache

FILE-NR: The number of file handles (files handle) used

INODE-NR: Number of uses of the index node handle (inode handle)

PTY-NR: Number of Pty used

3. Memory and swap space monitoring

For example, sampling every 10 seconds and sampling 3 times in a row requires you to type the following command:

Sar-r 10 3

The screen appears as follows:

　　

Output Item Description:

Kbmemfree: This value is basically the same as the free value in the command, so it does not include buffer and cache space.

Kbmemused: This value is basically the same as the used value in the free command, so it includes buffer and cache space.

%memused: This value is a percentage of kbmemused and total memory (excluding swap).

Kbbuffers and kbcached: These two values are the buffer and cache in the free command.

Kbcommit: Ensure that the current system requires memory (RAM+SWAP) in order to ensure that it does not overflow.

%commit: This value is a percentage of kbcommit and total memory (including swap).

4, Memory paging monitoring

For example, sampling every 10 seconds and sampling 3 times in a row requires you to type the following code:

Sar-b 10 3

The screen appears as follows:

　　

Output Item Description:

PGPGIN/S: Indicates the number of bytes per second from disk or swap to memory (KB)

PGPGOUT/S: Indicates the number of bytes per second from memory to disk or swap (KB)

FAULT/S: The number of pages per second that the system generates, that is, the sum of the primary and secondary page faults (major + minor)

MAJFLT/S: The number of main pages generated per second.

5. I/O and transfer rate monitoring

For example, sampling every 10 seconds, continuously sampling 3 times, reporting the use of buffers, you need to type the following command:

　　

Output Item Description:

TPS: Total I/O transfers per second for physical devices

Rtps: Total amount of data read from physical devices per second

Wtps: The total amount of data written to the physical device per second

BREAD/S: The amount of data read from the physical device per second, in blocks/s

BWRTN/S: The amount of data written to the physical device per second, in blocks/s

6. Process Queue Length and average load status monitoring

For example, sampling every 10 seconds, sampling 3 times in a row, monitoring the process queue length and the average load state, the code you need to type is as follows:

Sar-q 10 3

The screen appears as follows:

　　

Output Item Description:

Runq-sz: Length of the run queue (number of processes waiting to run)

Plist-sz: Number of processes (processes) and threads (threads) in the process list

Ldavg-1: Average system load for last 1 minutes (systems load average)

Ldavg-5: System average load over the last 5 minutes

Ldavg-15: System average load over the last 15 minutes

　　

7, System Exchange activity information monitoring

For example, sampling every 10 seconds, continuously sampling 3 times, monitoring system exchange activity information, you need to type the following code:

Sar-w 10 3

The screen appears as follows:

　　

The output is as follows:

PSWPIN/S: Number of swap pages per second system swapped in (Swap page)

PSWPOUT/S: Number of swap pages per second system swapped out (Swap page)

8. Monitoring of equipment usage

For example, sampling every 10 seconds, sampling 3 times in a row, reporting device usage, you need to type the following command:

Sar-d 3-p

　　

Output Item Description:

Parameter-P can print out the name of the disk device such as SDA,HDC, if not the parameter-p, the device node may be dev8-0,dev22-0

TPS: Number of times per second from physical disk I/O. Multiple logical requests are merged into one I/O disk request, and the size of one transfer is indeterminate.

RD_SEC/S: Number of Read sectors per second.

WR_SEC/S: Number of Write sectors per second.

Avgrq-sz: The average data size (sector) per device I/O operation.

Avgqu-sz: The average length of the disk request queue.

Await: The average elapsed time of each request, including the request queue wait time, in milliseconds (1 seconds =1000 milliseconds), from the request disk operation to the completion of the system processing.

SVCTM: The average time that the system processes each request, excluding the time consumed in the request queue.

%UTIL:I/O requests account for the percentage of the CPU, the higher the ratio, the more saturated the description.

1. When the value of Avgqu-sz is low, the equipment utilization is higher.

2. When the value of%util is close to 1%, it indicates that the device bandwidth is already full.

to determine the system bottleneck, it is sometimes necessary to combine several SAR command options.

Suspected CPU bottlenecks, sar-u and sar-q can be used to view

Suspect memory bottlenecks and can be viewed with Sar-b, sar-r, sar-w, etc.

Suspected I/O bottlenecks and can be viewed with Sar-b, sar-u, sar-d, etc.

Today leader to a task, write a monitoring server memory and other scripts, more than a certain threshold, will be the alarm, from the Internet search data, learned the SAR command, deliberately recorded down.

Original link: http://lovesoo.org/linux-sar-command-detailed.html

Linux SAR Command detailed