Linux Tools-sar Command

SAR (System activity Reporter report) is one of the most comprehensive system performance analysis tools available on Linux, which can be used to report the activities of the systems in many ways, including: Read and write of files, usage of system calls, disk I/O, CPU efficiency, Memory usage, process activity, and IPC-related activities. In this paper, the CentOS 7 x64 system is introduced as an example to introduce the SAR command.

Common formats for SAR commands
SAR [Options] [-A] [-o file] t [n]

which

T is the sampling interval, n is the number of samples, the default value is 1;

-o file means that the command result is stored in a binary format in a file, and file is a filename.

Options is a command-line option, and the SAR command is commonly used as follows:

-A: Sum of all reports

-U: Output statistics about CPU usage

-V: Output statistics for inode, files, and other kernel tables

-D: Output activity information for each block device

-r: Output memory and swap space statistics

-B: Display statistics for I/O and transfer rates

-A: File read and write status

-C: Output process statistics, number of processes created per second

-r: Output memory page statistics

-Y: terminal equipment activity situation

-W: Output system Exchange activity information

1. CPU Resource Monitoring

For example, sampling every 10 seconds, sampling 3 times in a row, observing CPU usage, and storing the sample results in binary form in the file test in the current directory, type the following command:

sar -u -o test 10 3

The screen appears as follows:

Output Item Description:

Cpu:all represents the average of the statistics for all CPUs.

%user: Displays the percentage of total CPU time that is running at the user level (application).

%nice: The percentage of total CPU time that is displayed at the user level for the nice operation.

%system: The percentage of total CPU time that is used to run at the core level (kernel).

%iowait: Displays the percentage of total CPU time that is used to wait for I/O operations.

%steal: The percentage of the hypervisor (hypervisor) that waits for a virtual CPU to serve another virtual process.

%idle: Shows the percentage of CPU idle time that takes up the total CPU time.

1. If the%iowait value is too high, the hard disk has an I/O bottleneck

2. If the value of the%idle is high but the system responds slowly, it is possible that the CPU waits for the allocated memory, which should increase the memory capacity

3. If the value of%idle is consistently below 1, the system has a relatively low CPU capacity, indicating that the most necessary resource to be addressed in the system is the CPU.

If you want to view the contents of a binary file test, you would type the following SAR command:

sar -u -f test

2. Inode, file, and other kernel table monitoring

For example, sampling every 10 seconds, sampling 3 times in a row, observing the status of the core table, you need to type the following command:

sar -v 10 3

The screen appears as follows:

Output Item Description:

DENTUNUSD: Number of unused entries in the directory cache

FILE-NR: The number of file handles (files handle) used

INODE-NR: Number of uses of the index node handle (inode handle)

PTY-NR: Number of Pty used

3. Memory and swap space monitoring

For example, sampling every 10 seconds, sampling 3 times in a row, monitoring memory paging:

sar -r 10 3

The screen appears as follows:

Output Item Description:

Kbmemfree: This value is basically the same as the free value in the command, so it does not include buffer and cache space.

Kbmemused: This value is basically the same as the used value in the free command, so it includes buffer and cache space.

%memused: This value is a percentage of kbmemused and total memory (excluding swap).

Kbbuffers and kbcached: These two values are the buffer and cache in the free command.

Kbcommit: Ensure that the current system requires memory (RAM+SWAP) in order to ensure that it does not overflow.

%commit: This value is a percentage of kbcommit and total memory (including swap).

4. Memory Paging Monitoring

For example, sampling every 10 seconds, sampling 3 times in a row, monitoring memory paging:

sar -B 10 3

The screen appears as follows:

Output Item Description:

PGPGIN/S: Indicates the number of bytes per second from disk or swap to memory (KB)

PGPGOUT/S: Indicates the number of bytes per second from memory to disk or swap (KB)

FAULT/S: The number of pages per second that the system generates, that is, the sum of the primary and secondary page faults (major + minor)

MAJFLT/S: The number of main pages generated per second.

PGFREE/S: Number of pages per second that are placed in the free queue

PGSCANK/S: Number of pages scanned per second by KSWAPD

PGSCAND/S: Number of pages scanned directly per second

PGSTEAL/S: The number of pages per second that are purged from the cache to meet memory requirements

%vmeff: Percentage of pages purged per second (pgsteal) in total scan page (Pgscank+pgscand)

5. I/O and transfer rate monitoring

For example, sampling every 10 seconds, sampling 3 times in a row, reporting the use of the buffer, you need to type the following command:

sar -b 10 3

The screen appears as follows:

Output Item Description:

TPS: Total I/O transfers per second for physical devices

Rtps: Total amount of data read from physical devices per second

Wtps: The total amount of data written to the physical device per second

BREAD/S: The amount of data read from the physical device per second, in blocks/s

BWRTN/S: The amount of data written to the physical device per second, in blocks/s

6. Process Queue Length and average load status monitoring

For example, sampling every 10 seconds, sampling 3 times in a row, monitoring process queue length and average load status:

sar -q 10 3

The screen appears as follows:

Output Item Description:

Runq-sz: Length of the run queue (number of processes waiting to run)

Plist-sz: Number of processes (processes) and threads (threads) in the process list

Ldavg-1: Average system load for last 1 minutes (systems load average)

Ldavg-5: System average load over the last 5 minutes

Ldavg-15: System average load over the last 15 minutes

7. System Exchange activity Information monitoring

For example, samples are sampled every 10 seconds, sampled 3 times in a row, monitoring system exchange activity information:

sar -    W 10 3

The screen appears as follows:

Output Item Description:

PSWPIN/S: Number of swap pages per second system swapped in (Swap page)

PSWPOUT/S: Number of swap pages per second system swapped out (Swap page)

8. Monitoring of equipment usage

For example, sampling every 10 seconds, sampling 3 consecutive times, reporting device usage, you need to type the following command:

 sar -d 10 3 –p

The screen appears as follows:

which

Parameter-P can print out the name of the disk device such as SDA,HDC, if not the parameter-p, the device node may be dev8-0,dev22-0

TPS: Number of times per second from physical disk I/O. Multiple logical requests are merged into one I/O disk request, and the size of one transfer is indeterminate.

RD_SEC/S: Number of Read sectors per second.

WR_SEC/S: Number of Write sectors per second.

Avgrq-sz: The average data size (sector) per device I/O operation.

Avgqu-sz: The average length of the disk request queue.

Await: The average elapsed time of each request, including the request queue wait time, in milliseconds (1 seconds =1000 milliseconds), from the request disk operation to the completion of the system processing.

SVCTM: The average time that the system processes each request, excluding the time consumed in the request queue.

%UTIL:I/O requests account for the percentage of the CPU, the higher the ratio, the more saturated the description.

1. When the value of Avgqu-sz is low, the equipment utilization is high.

2. When the value of%util is close to 1%, the device bandwidth is already full.

9. View network card Traffic Information • View network card devices

The-n parameter is to view network card information, including traffic, etc.

The-n parameter is useful, he has 6 different switches: DEV | Edev | NFS | NFSD | SOCK | All. The dev Displays the network interface information, Edev displays statistics about network errors, NFS Statistics active NFS Client information, NFSD statistics Server for NFS, sock displays socket information, all shows all 5 switches. They can be used alone or together. We're going to use the-N dev now.

sar –n DEV 1 4

Iface:lan interface
RXPCK/S: Packets Received per second
TXPCK/S: Packets Sent per second
rxbyt/s: Number of bytes received per second
txbyt/s: Number of bytes sent per second
RXCMP/S: Compressed packets received per second
TXCMP/S: Compressed packets sent per second
RXMCST/S: Multicast packets received per second

viewing abnormal traffic (error)

sar –n DEV 1 4

Iface:lan interface
RXERR/S: Bad packets received per second
TXERR/S: Bad packets sent per second

COLL/S: Number of collisions per second
RXDROP/S: The number of received packets dropped per second because the buffer is full
TXDROP/S: The number of sent packets dropped per second because the buffer is full
TXCARR/S: The number of carrier errors per second when sending packets
RXFRAM/S: Number of frame alignment errors received per second for packets
RXFIFO/S: Number of errors received per second FIFO over-speed
TXFIFO/S: Number of errors sent packets per second FIFO over-speed

Linux Tools-sar Command