How to Analyze Server Resources Using Sar

When reviewing the resources utilized by your server, there are a plethora of tools at your disposal. The sar command is a powerful Linux command line utility that can be used to review a server’s resource usage.

Using sar

The most basic use of the command sar is without any flags. This usage shows you how the central processing unit usage of the server breaks down over the given intervals. By default, sar will show from midnight to the current time, in ten minute increments.

[root@host] ~ >> sar
12:00:01 AM       CPU     %user     %nice   %system   %iowait    %steal     %idle
12:10:01 AM       all      0.25      0.01      0.09      0.75      0.00     98.90
12:20:01 AM       all      0.15      0.01      0.07      0.10      0.00     99.66
12:30:02 AM       all      0.14      0.01      0.07      0.06      0.00     99.72
12:40:01 AM       all      0.13      0.01      0.08      0.05      0.00     99.74
12:50:01 AM       all      0.13      0.01      0.07      0.28      0.00     99.51
01:00:01 AM       all      0.13      0.01      0.07      0.03      0.00     99.77
01:10:01 AM       all      0.22      0.02      0.09      0.09      0.00     99.59


The first column is the time. The CPU column states that all the central processing units are being used to calculate these numbers. %user is the percentage of the CPU time spent on executing user level applications. %nice is the percentage of the CPU time spent on executing processes with a nice priority. %system is the percentage of the CPU time spent on system tasks. %iowait is the percentage of CPU time the CPUs were idle during long disk Input/Output periods. %steal is the percentage of CPU time spent in involuntary wait by the virtual CPU or CPUs while the server was servicing another virtual processor. And %idle is the amount of time the CPUs were idle.

As you can tell from the example above, the server wasn’t doing much with the CPU from midnight to one am. If the %iowait column had a consistently high percentage, that could be an indicator that the CPU is often waiting for the hard disks to finish writing in order to carry out its processes.

Like all Linux command-line utilities, sar has flags that will modify its output. The manual page for sar has an almost overwhelming number of flags that can be used, so we will only focus on a few of them.

The -r flag for the sar command shows server memory usage, both Random Access Memory and swapfile. The output from that command looks like this:

[root@host] ~ >> sar -r
12:00:01 AM kbmemfree kbmemused  %memused kbbuffers  kbcached kbswpfree kbswpused  %swpused  kbswpcad
12:10:01 AM     63852   1694200     96.37    191192    993568   1959852        68      0.00         0
12:20:01 AM     62572   1695480     96.44    191200    993596   1959852        68      0.00         0
12:30:02 AM     62936   1695116     96.42    191200    993616   1959852        68      0.00         0
12:40:01 AM     58188   1699864     96.69    191212    993732   1959852        68      0.00         0
12:50:01 AM     58460   1699592     96.67    191212    993768   1959852        68      0.00         0
01:00:01 AM     57172   1700880     96.75    191212    993784   1959852        68      0.00         0
01:10:01 AM     57000   1701052     96.76    191212    993808   1959852        68      0.00         0


Like sar without any commands, the first column is the time of the server. kbmemfree is the amount of free memory in kilobytes. kbmemused is the amount of used memory in kilobytes. %memused is the percentage of how much memory was being used. kbbuffers is the amount of buffer space used by the kernel in kilobytes. kbcached is the amount of cached space used by the kernel in kilobytes. kbswpfree is the amount of free swapfile space in kilobytes. kbswpused is the amount of used swapfile space in kilobytes. %swpused is percentage of swapfile used. kbswpcad is the amount of cached swap memory in kilobytes.

Generally speaking, Linux servers run with most of their memory in use. The Linux kernel is designed to use free RAM as a cache of frequently accessed files in order to speed up requests. The sar -r command is useful because it can show if the server is using a lot of swapfile memory, or swapping. Linux only uses the swapfile if it has run out of memory to do all of its tasks. When a server swaps, it can be an indication that something is wrong or that the server is due for an upgrade.

Refining sar’s results

By default, sar displays the current day’s information. Sar does keep previous days worth of information. Those files are kept in /var/log/sa/. You can access them with the following command

[host] ~ >> sar -f /var/log/sa/sa02

The number is always the day of the month. In the above example, we are looking at the 2nd’s information. Other flags can be used with the -f flag to get a more refined search.

In addition to choosing a different day, sar allows for starting or ending output at times other than the defaults. The -s flag sets a new start time other than midnight and -e sets a new end time other than the current time.  Both flags are HH:MM:SS format. If we wanted to view the CPU usage of the server from 9am to 10:30am we would use the following command.

[root@host] ~ >> sar -s 09:00:00 -e 10:30:00
09:00:01 AM       CPU     %user     %nice   %system   %iowait    %steal     %idle
09:10:01 AM       all      0.22      0.01      0.09      0.06      0.00     99.62
09:20:01 AM       all      0.13      0.01      0.07      0.06      0.00     99.73
09:30:01 AM       all      0.12      0.01      0.07      0.02      0.00     99.76
09:40:01 AM       all      0.13      0.01      0.07      0.03      0.00     99.76
09:50:01 AM       all      0.13      0.01      0.07      0.02      0.00     99.77
10:00:01 AM       all      0.13      0.01      0.07      0.05      0.00     99.73
10:10:01 AM       all      0.23      0.01      0.09      0.04      0.00     99.63
10:20:01 AM       all      0.13      0.02      0.08      0.03      0.00     99.75
Average:          all      0.15      0.01      0.08      0.04      0.00     99.72


Sar is a useful tool for monitoring and analyzing server resource usage. The amount of information it can provide can be overwhelming. With the right flags sar can help track down potential resource usage problems before they cause a disaster.

===

Liquid Web’s Heroic Support is always available to assist customers with this or any other issue. If you need our assistance please contact us:
Toll Free 1.800.580.4985
International 517.322.0434
support@liquidweb.com
https://my.liquidweb.com/