How to Analyze Server Resources Using Sar
When reviewing the resources utilized by your server, there are a plethora of tools at your disposal. The sar command is a powerful Linux command line utility that can be used to review a server’s resource usage.
The most basic use of the command sar is without any flags. This usage shows you how the central processing unit usage of the server breaks down over the given intervals. By default, sar will show from midnight to the current time, in ten minute increments.
[root@host] ~ >> sar
12:00:01 AM CPU %user %nice %system %iowait %steal %idle
12:10:01 AM all 0.25 0.01 0.09 0.75 0.00 98.90
12:20:01 AM all 0.15 0.01 0.07 0.10 0.00 99.66
12:30:02 AM all 0.14 0.01 0.07 0.06 0.00 99.72
12:40:01 AM all 0.13 0.01 0.08 0.05 0.00 99.74
12:50:01 AM all 0.13 0.01 0.07 0.28 0.00 99.51
01:00:01 AM all 0.13 0.01 0.07 0.03 0.00 99.77
01:10:01 AM all 0.22 0.02 0.09 0.09 0.00 99.59
The first column is the time. The CPU column states that all the central processing units are being used to calculate these numbers. %user is the percentage of the CPU time spent on executing user level applications. %nice is the percentage of the CPU time spent on executing processes with a nice priority. %system is the percentage of the CPU time spent on system tasks. %iowait is the percentage of CPU time the CPUs were idle during long disk Input/Output periods. %steal is the percentage of CPU time spent in involuntary wait by the virtual CPU or CPUs while the server was servicing another virtual processor. And %idle is the amount of time the CPUs were idle.
As you can tell from the example above, the server wasn’t doing much with the CPU from midnight to one am. If the %iowait column had a consistently high percentage, that could be an indicator that the CPU is often waiting for the hard disks to finish writing in order to carry out its processes.
Like all Linux command-line utilities, sar has flags that will modify its output. The manual page for sar has an almost overwhelming number of flags that can be used, so we will only focus on a few of them.
The -r flag for the sar command shows server memory usage, both Random Access Memory and swapfile. The output from that command looks like this:
[root@host] ~ >> sar -r
12:00:01 AM kbmemfree kbmemused %memused kbbuffers kbcached kbswpfree kbswpused %swpused kbswpcad
12:10:01 AM 63852 1694200 96.37 191192 993568 1959852 68 0.00 0
12:20:01 AM 62572 1695480 96.44 191200 993596 1959852 68 0.00 0
12:30:02 AM 62936 1695116 96.42 191200 993616 1959852 68 0.00 0
12:40:01 AM 58188 1699864 96.69 191212 993732 1959852 68 0.00 0
12:50:01 AM 58460 1699592 96.67 191212 993768 1959852 68 0.00 0
01:00:01 AM 57172 1700880 96.75 191212 993784 1959852 68 0.00 0
01:10:01 AM 57000 1701052 96.76 191212 993808 1959852 68 0.00 0
Like sar without any commands, the first column is the time of the server. kbmemfree is the amount of free memory in kilobytes. kbmemused is the amount of used memory in kilobytes. %memused is the percentage of how much memory was being used. kbbuffers is the amount of buffer space used by the kernel in kilobytes. kbcached is the amount of cached space used by the kernel in kilobytes. kbswpfree is the amount of free swapfile space in kilobytes. kbswpused is the amount of used swapfile space in kilobytes. %swpused is percentage of swapfile used. kbswpcad is the amount of cached swap memory in kilobytes.
Generally speaking, Linux servers run with most of their memory in use. The Linux kernel is designed to use free RAM as a cache of frequently accessed files in order to speed up requests. The sar -r command is useful because it can show if the server is using a lot of swapfile memory, or swapping. Linux only uses the swapfile if it has run out of memory to do all of its tasks. When a server swaps, it can be an indication that something is wrong or that the server is due for an upgrade.
Refining sar’s results
By default, sar displays the current day’s information. Sar does keep previous days worth of information. Those files are kept in /var/log/sa/. You can access them with the following command
[host] ~ >> sar -f /var/log/sa/sa02
The number is always the day of the month. In the above example, we are looking at the 2nd’s information. Other flags can be used with the -f flag to get a more refined search.
In addition to choosing a different day, sar allows for starting or ending output at times other than the defaults. The -s flag sets a new start time other than midnight and -e sets a new end time other than the current time. Both flags are HH:MM:SS format. If we wanted to view the CPU usage of the server from 9am to 10:30am we would use the following command.
[root@host] ~ >> sar -s 09:00:00 -e 10:30:00
09:00:01 AM CPU %user %nice %system %iowait %steal %idle
09:10:01 AM all 0.22 0.01 0.09 0.06 0.00 99.62
09:20:01 AM all 0.13 0.01 0.07 0.06 0.00 99.73
09:30:01 AM all 0.12 0.01 0.07 0.02 0.00 99.76
09:40:01 AM all 0.13 0.01 0.07 0.03 0.00 99.76
09:50:01 AM all 0.13 0.01 0.07 0.02 0.00 99.77
10:00:01 AM all 0.13 0.01 0.07 0.05 0.00 99.73
10:10:01 AM all 0.23 0.01 0.09 0.04 0.00 99.63
10:20:01 AM all 0.13 0.02 0.08 0.03 0.00 99.75
Average: all 0.15 0.01 0.08 0.04 0.00 99.72
Sar is a useful tool for monitoring and analyzing server resource usage. The amount of information it can provide can be overwhelming. With the right flags sar can help track down potential resource usage problems before they cause a disaster.
Liquid Web’s Heroic Support is always available to assist customers with this or any other issue. If you need our assistance please contact us:
Toll Free 1.800.580.4985
About the Author: Matt Aurand
Our Sales and Support teams are available 24 hours by phone or e-mail to assist.
What Is WebP and What Makes it Different from Other Image Formats?Read Article
Top 10 Password Security StandardsRead Article
Top 10 Password Security StandardsRead Article
How to Install MongoDB on AlmaLinuxRead Article
How to Use the WP Toolkit to Secure and Update WordPressRead Article