SAR detail (Linux/unix Universal)

Reprint: http://www.toxingwang.com/linux-unix/2027.html

SAR is a common performance reporting tool for Linux and UNIX, and the common command combinations are as follows:

Common formats for the SAR command line:

SAR [Options] [-A] [-o file] t [n]

SAR [Options] [< time interval > [< times >]]

In the command line, the N and t two parameters are combined to define the sampling interval and the number of times, T is the sampling interval, which must be

The parameters, n is the number of samples, is optional, the default value is 1,-o file means the command result in binary format

stored in a file, where filename is not a keyword and is a file name. Options is the command line option, the SAR command

There are a lot of options listed below, only the common options:

-A sum of all reports

-A file read, write report

-B reports additional buffer cache usage

-B Buffer Cache usage

-C System invoke usage report

-D HDD Usage Report

-H About Buffer usage statistics

-m IPC message and beacon activity

-P Paging Activity

The average length of the-Q run queue and the interchange queue

-R reporting Process activities

-R does not use memory pages and hard disk blocks

-U CPU Utilization

-V process, I node, file and lock table status

-W System Switching activity

-Y TTY Device activity

An example is shown below.

Example one: Reporting CPU usage, using the command line Sar-u T n

For example, sampling every 60 seconds, sampling 5 times in a row, observing CPU usage, and sampling results in binary

Form into the file Sar.out in the current directory, type the following command:

[Email protected]:/home#sar-u-O sar.out 60 5

HP-UX prddb1 b.11.31 U IA64 01/06/14

09:52:54%usr%sys%wio%idle

09:53:54 39 9 45 7

09:54:54 47 9 38 6

09:55:54 46 9 38 7

09:56:54 44 9 40 6

09:57:54 40 8 45 7

Average 43 9 41 7

The contents of the display include:

• %usr:cpu the percentage of time in user mode.
• %sys:cpu the percentage of time in system mode.
• %wio:cpu the percentage of time to wait for the input output to finish.
• %IDLE:CPU idle time percentage.

In all the display, we should pay attention to the value of%wio and%idle,%wio is too high, indicating that there is an I/O bottleneck on the hard disk, the%idle value is high, the CPU is idle, if the%idle value is high but the system response is slow, it is possible that the CPU waits to allocate memory, this should increase the memory capacity. If the%idle value continues below 10, the system's CPU processing power is relatively low, indicating that the most resource to be addressed in the system is the CPU.

If you want to view the contents of the binary file sar.out, you need to type the following SAR command:

# sar-u-F Sar.out

As a result, SAR commands can be sampled in real time and the results of previous samples can be queried.

Example two: report the core table state, using the SAR-V T n

For example, sampling every 5 seconds, sampling 3 times in a row, observing the status of the core table, you need to type the following command:

[Email protected]:/#sar-V 5 3

HP-UX prddb1 b.11.31 U IA64 01/06/14

14:32:28 text-sz ov Proc-sz ov inod-sz ov File-sz ov
14:32:33 N/A N/a 335/4200 0 2227/139264 0 2579/2147483647 0
14:32:38 N/A N/a 335/4200 0 2227/139264 0 2581/2147483647 0
14:32:43 N/A N/a 335/4200 0 2227/139264 0 2584/2147483647 0

Display content includes:

• Proc-sz: The number of table entries in the process table currently being used or allocated in the core, controlled by the core parameter max-proc.
• Inod-sz: The number of table entries in the I-node table currently being used or allocated in the core, controlled by the core parameter max-inode.
• File-sz: The number of table entries in the file table currently being used or allocated in the core, controlled by the core parameter max-file.
• OV: The number of times the overflow occurred.
• Lock-sz: The number of table entries that are currently being used or allocated in the core are locked and controlled by the core parameters Max-flckre.

The display format is:

Actual use of table items/can use the number of table items display content representation, the core use is completely normal, three tables no overflow phenomenon, the core parameters do not need to adjust, if overflow, to adjust the corresponding core parameters, the corresponding number of table items increased.

Example three: Reporting disk usage, using sar-d t n

For example, sampling every 5 seconds, sampling 3 consecutive times, reporting device usage, you need to type the following command:

[Email protected]:/#sar-D 5 3

HP-UX prddb1 b.11.31 U IA64 01/06/14

10:17:47 device%busy avque r+w/s blks/s avwait avserv

10:17:52 disk33 0.40 0.50 1 10 0.00 5.02

DISK34 100.00 0.50 824 35543 0.00 10.74

DISK35 100.00 0.50 2387 86635 0.00 9.77

DISK67 100.00 0.50 454 17651 0.00 14.35

10:17:57 disk33 2.01 0.50 3 35 0.48 21.28

DISK34 100.00 0.50 751 34238 0.00 12.11

DISK35 100.00 0.50 1799 74124 0.00 11.93

DISK67 100.00 0.50 407 14429 0.00 14.71

10:18:02 disk33 2.59 0.50 4 36 0.00 7.46

DISK34 100.00 0.50 634 30645 0.00 12.69

DISK35 100.00 0.50 1611 74142 0.00 13.54

disk67 100.00 0.50 354 13294 0.00 14.99

Average disk33 1.66 0.50 3 27 0.18 12.49

Average disk34 100.00 0.50 736 33473 0.00 11.76

Average disk35 100.00 0.50 1933 78311 0.00 11.49

Average disk67 100.00 0.50 405 15126 0.00 14.66

Display content includes:

• The Device:sar command is monitoring the name of the block device.
• %busy: The percentage of time that the transfer request takes up when the device is busy.
• Avque: The average number of requests not completed when the queue is full.
• R+W/S: The amount of data transmitted to or from the device per second.
• BLKS/S: Number of blocks transmitted per second, 512 bytes per block.
• Avwait: The average time that the transmit request waits for the queue to be idle when the queue is full.
• Avserv: The average time (in milliseconds) required to complete the transfer request.

In the displayed content, disk# #是硬盘的名字, the value of%busy is small, indicating that the effective time for processing the transfer request is too small, the file system is inefficient, generally speaking, the%busy value is higher, the Avque value is lower, the file system efficiency is higher, if the% Busy and Avque values are relatively high, indicating that the hard drive transmission speed is too slow, need to adjust.

Example four: Reporting buffer usage, using Sar-b t n

For example, sampling every 5 seconds, sampling 3 times in a row, reporting the use of the buffer, you need to type the following command:

[Email protected]:/#sar-B 5 3

HP-UX prddb1 b.11.31 U IA64 01/06/14

10:20:46 bread/s lread/s%rcache bwrit/s lwrit/s%wcache pread/s pwrit/s

10:20:51 0 5029 100 24 27 13 0 0

10:20:56 0 4335 100 21 22 6 0 0

10:21:01 0 5118 100 22 26 13 0 0

Average 0 4827 100 22 25 11 0 0

Display content includes:

• BREAD/S: The number of physical blocks per second read from the hard disk into the system buffer.
• LREAD/S: The average number of logical blocks read from the system buffer per second.
• %rcache: The percentage of logical reads in the buffer cache.
• BWRIT/S: The average number of physical blocks written to disk per second from the system buffer.
• LWRIT/S: The average number of logical blocks per second written to the system buffer.
• %wcache: The percentage of logical reads in the buffer cache.
• PREAD/S: The average number of physical reads requested per second.
• PWRIT/S: The average number of physical writes per second requested.

In the displayed content, the most important is the%cache and%wcache two columns, their values reflect the efficiency of the use of buffer, the value of%rcache less than 90 or the value of%wcache is less than 65, should increase the number of system buffer appropriately, Buffer number by the core parameter Nbuf control, so that the%rcache reached about 90,%wcache reached about 80. But the buffer parameter value of how much affect I/O efficiency, increase buffer, should be in the case of large memory, otherwise the system efficiency is not improved.

There are many uses of the SAR command, sometimes judging a problem, it takes several SAR commands to combine, for example, suspected CPU bottlenecks, usable sar-u and sar-q, suspected I/O bottlenecks, can be seen in Sar-b, Sar-u and sar-d

Example five: report file read and write, use command sar-a t n

[Email protected]:/home#sar-a 5 3

HP-UX prddb1 b.11.31 U IA64 01/06/14

10:31:23 iget/s namei/s dirbk/s

10:31:28 0 178 2

10:31:33 0 220 3

10:31:38 0 164 4

Average 0 187 3

Display content includes:

• IGET/S number of files per second that are located by the I node entry
• NAMEI/S number of file system path queries per second
• DIRBK/S number of directory blocks read per second

* The larger these values indicate that the more time the core spends on accessing user files, it reflects the load generated by some programs and application file systems. Generally, if the ratio of iget/s to namei/s is greater than 5, and the value of NAMEI/S is greater than 30, the file system is inefficient. You need to check the file system for free space and see if there is too little free space.

Example VI: Reporting of communication activities between processes (IPC messages and beacon activity)

[Email protected]:/#sar-M 4 3

HP-UX prddb1 b.11.31 U IA64 01/06/14

14:16:30 msg/s sema/s

14:16:34 1384.79 906.48

14:16:38 1212.97 799.25

14:16:42 789.25 905.00

Average 1129.28 870.22

Display content includes:

• MSG/S the number of message operations per second (including the receive information for sending messages).
• SEMA/S the number of semaphore operations per second.

* semaphores and messages as tools for interprocess communication, the value of MSG and SEMA reported by the SAR command will be equal to 0.00 if they are not used during the application running in the system. If these tools are used, and either msg/s is greater than 100, or sema/s is greater than 100, then the application is less efficient. The reason is that in such an application, a lot of time is spent on communication between processes, which inevitably has a negative impact on ensuring that the process itself is running efficiently.

Example VII: Reporting paging activity

Under Linux, use the following:

[[email protected] ~]# Sar-u-P 0 5 3

Linux 2.6.32-431.el6.x86_64 (nagios.aisidi.com) January 06, 2014 _x86_64_ (2 CPU)

14:14 39 sec CPU%user%nice%system%iowait%steal%idle

14:14 44 sec All 12.47 0.00 5.68 0.00 0.00 81.85

14:14 49 sec All 61.03 0.00 1.42 0.00 0.00 37.55

14:14 54 sec All 14.39 0.00 0.75 0.00 0.00 84.85

Average time: All 29.60 0.00 2.65 0.00 0.00 67.75

HP-UX needs to be used with-u or-Q and requires the CPU to be specified as follows:

[Email protected]:/#sar-U-P 0 2 3

HP-UX prddb1 b.11.31 U IA64 01/06/14

14:22:52%usr%sys%wio%idle

14:22:54 70 6 17 6

14:22:56 77 5 12 5

14:22:58 68 5 15 11

Average 72 6 15 8

Display content includes:

• VFLT/S the number of page fault address conversions per second (because a valid page is not currently in memory).
• PFLT/S per second from the number of page faults due to protection errors (due to the illegal storage of the page, resulting in a page failure).
• PGFIL/S the number of vflt/s per second through "page-in".
• rclm/s the number of active pages per second that are recovered by the system. The active page is added to the free page queue.

* If the value of vflt/s is higher than 100, it may indicate that the application is inefficient for the page system, that the paging parameter needs to be adjusted, or that the memory configuration is not appropriate.

Example VIII: report the status of the process queue (the average length of the run queue and the interchange queue)

[Email protected]:/#sar-Q 2 3

HP-UX prddb1 b.11.31 U IA64 01/06/14

14:25:21 Runq-sz%RUNOCC Swpq-sz%SWPOCC

14:25:23 1.2 46 0.0 0

14:25:25 1.0 42 0.0 0

14:25:27 1.2 17 0.0 0

Average 1.1 35 0.0 0

Display content includes:

• Runq-sz the running queue for the running process.
• %RUNOCC elapsed time (in percent) of the run queue
• Swpq-sz the process Exchange queue to be swapped out.
• %SWPOCC the time (in percent) that the interchange queue was occupied.

* If%RUNOCC is greater than 90 and the value of Runq-sz is greater than 2, the CPU load is heavier. The direct result of the system may reduce the response speed. If the%SWPOCC is greater than 20, it indicates that the switching activity is frequent and will seriously result in system efficiency degradation. The solution is to increase the memory or reduce the number of buffers, thereby reducing the exchange and page-in, page-out activities.

Example IX: Reporting memory and swap usage (unused memory pages and hard disk blocks), HP-UX does not support

[Email protected] ~]# Sar-r 2 3

Linux 2.6.32-431.el6.x86_64 (nagios.aisidi.com) January 06, 2014 _x86_64_ (2 CPU)

14:26 26 sec kbmemfree kbmemused%memused kbbuffers kbcached kbcommit%commit

14:26 28 sec 559572 460564 45.15 42048 145256 702880 22.79

14:26 30 sec 536416 483720 47.42 42056 145356 967436 31.36

14:26 32 sec 536464 483672 47.41 42064 145356 967436 31.36

Average time: 544151 475985 46.66 42056 145323 879251 28.51

Display content includes:

• Kbmemfree The amount of free memory, in kilobytes.
• Kbmemused The amount of memory used, in kilobytes. This does not take into account the memory used by the kernel.
• %memused the percentage of memory that has been used.
• Kbbuffers The amount of memory, in kilobytes, used for the kernel buffer.
• Kbcached The amount of memory, in kilobytes, used for the kernel to cache data.
• There is a need for the current amount of KB in Kbcommit.
• %commit the percentage of memory that is required for the current workload (physical memory +swap). This number may be greater than 100% because the kernel is usually over commits memory.

Example ten: Reporting System exchange activities

[Email protected]:/#sar-W 2 3

HP-UX prddb1 b.11.31 U IA64 01/06/14

14:27:43 swpin/s bswin/s swpot/s bswot/s pswch/s

14:27:45 0.00 0.0 0.00 0.0 19280

14:27:47 0.00 0.0 0.00 0.0 6114

14:27:49 0.00 0.0 0.00 0.0 22083

Average 0.00 0.0 0.00 0.0 15836

Display content includes:

• SWPIN/S the number of times per second The memory is transferred from the hard disk swap area.
• BSWIN/S the number of blocks that are transferred per second for swapping in.
• SWPOT/S the number of times per second transferred from memory to the hard drive swap area.
• Bswots the number of blocks transferred per second for swap out.
• PSWCH/S the number of process exchanges per second.

*SWPIN/S,BSWIN/S,SWPOT/S and Bswots describe the exchange activity associated with the hard disk swap area. Exchange relates to the efficiency of the system. Swap area on hard disk read, write operation than memory read, write much slower, therefore, in order to improve the efficiency of the system should try to reduce the exchange. The usual practice is to increase the memory so that the switching activity in the swap area is zero or close to zero. If the value of SWPOT/S is greater than 1, it may be necessary to increase memory or reduce the buffer (which reduces the amount of free memory space that the buffer can free).

Example 11: Reporting the I/O activity of the terminal (TTY device activity)

[Email protected]:/#sar-y 2 3

HP-UX prddb1 b.11.31 U IA64 01/06/14

14:28:43 rawch/s canch/s outch/s rcvin/s xmtin/s mdmin/s

14:28:45 0 0 0 0 0 0

14:28:47 0 0 0 0 0 0

14:28:49 0 0 0 0 0 0

Average 0 0 0 0 0 0

Display content includes:

• RAWCH/S number of characters entered per second (original queue)
• CANCH/S the number of input characters per second processed by the regular queue (canonical queue). In the process of regular processing, some characters with special meanings can be identified. For example, (break characters), (exit character), (backspace), etc. Therefore, the count in canch/s does not include these characters that have special meanings.
• OUTCH/S the number of characters output per second.
• RCVIN/S the number of hardware interrupts received per second.
• XMTIN/S the number of hardware interrupts issued per second.
• MDMIN/S the number of modem interrupts per second.

* In particular, the SAR command can be used to count any terminal activity, the so-called arbitrary terminal, refers to any TTY device. They can be serial terminal, console, pseudo terminal and so on.

* In these quantities, the modem interrupt number MDMIN/S should be close to 0. There are no special requirements, but if each character is sent, the number of interrupts increases dynamically, indicating that the terminal line has gone wrong and may be in bad contact.

SAR detail (Linux/unix Universal)