Reading Time: 4 minutes
When reviewing the resources utilized by your server, there are a plethora of tools at your disposal. The sar command is a powerful Linux command line utility that can be used to review a server’s resource usage.
The most basic use of the command sar is without any flags. This usage shows you how the central processing unit usage of the server breaks down over the given intervals. By default, sar will show from midnight to the current time, in ten minute increments.
[root@host] ~ >> sar
12:00:01 AM CPU %user %nice %system %iowait %steal %idle
12:10:01 AM all 0.25 0.01 0.09 0.75 0.00 98.90
12:20:01 AM all 0.15 0.01 0.07 0.10 0.00 99.66
12:30:02 AM all 0.14 0.01 0.07 0.06 0.00 99.72
12:40:01 AM all 0.13 0.01 0.08 0.05 0.00 99.74
12:50:01 AM all 0.13 0.01 0.07 0.28 0.00 99.51
01:00:01 AM all 0.13 0.01 0.07 0.03 0.00 99.77
01:10:01 AM all 0.22 0.02 0.09 0.09 0.00 99.59
The first column is the time. The CPU
column states that all the central processing units are being used to calculate these numbers. %user
is the percentage of the CPU time spent on executing user level applications. %nice
is the percentage of the CPU time spent on executing processes with a nice priority. %system
is the percentage of the CPU time spent on system tasks. %iowait
is the percentage of CPU time the CPUs were idle during long disk Input/Output periods. %steal
is the percentage of CPU time spent in involuntary wait by the virtual CPU or CPUs while the server was servicing another virtual processor. And %idle
is the amount of time the CPUs were idle.
As you can tell from the example above, the server wasn’t doing much with the CPU from midnight to one am. If the %iowait column had a consistently high percentage, that could be an indicator that the CPU is often waiting for the hard disks to finish writing in order to carry out its processes.
Like all Linux command-line utilities, sar has flags that will modify its output. The manual page for sar has an almost overwhelming number of flags that can be used, so we will only focus on a few of them.
The -r flag
for the sar command shows server memory usage, both Random Access Memory and swapfile. The output from that command looks like this:
[root@host] ~ >> sar -r
12:00:01 AM kbmemfree kbmemused %memused kbbuffers kbcached kbswpfree kbswpused %swpused kbswpcad
12:10:01 AM 63852 1694200 96.37 191192 993568 1959852 68 0.00 0
12:20:01 AM 62572 1695480 96.44 191200 993596 1959852 68 0.00 0
12:30:02 AM 62936 1695116 96.42 191200 993616 1959852 68 0.00 0
12:40:01 AM 58188 1699864 96.69 191212 993732 1959852 68 0.00 0
12:50:01 AM 58460 1699592 96.67 191212 993768 1959852 68 0.00 0
01:00:01 AM 57172 1700880 96.75 191212 993784 1959852 68 0.00 0
01:10:01 AM 57000 1701052 96.76 191212 993808 1959852 68 0.00 0
Like sar without any commands, the first column is the time of the server. kbmemfree
is the amount of free memory in kilobytes. kbmemused
is the amount of used memory in kilobytes. %memused
is the percentage of how much memory was being used. kbbuffers
is the amount of buffer space used by the kernel in kilobytes. kbcached
is the amount of cached space used by the kernel in kilobytes. kbswpfree
is the amount of free swapfile space in kilobytes. kbswpused
is the amount of used swapfile space in kilobytes. %swpused
is percentage of swapfile used. kbswpcad
is the amount of cached swap memory in kilobytes.
Generally speaking, Linux servers run with most of their memory in use. The Linux kernel is designed to use free RAM as a cache of frequently accessed files in order to speed up requests. The sar -r command is useful because it can show if the server is using a lot of swapfile memory, or swapping. Linux only uses the swapfile if it has run out of memory to do all of its tasks. When a server swaps, it can be an indication that something is wrong or that the server is due for an upgrade.
Refining sar’s results
By default, sar displays the current day’s information. Sar does keep previous days worth of information. Those files are kept in /var/log/sa/. You can access them with the following command
[host] ~ >> sar -f /var/log/sa/sa02
The number is always the day of the month. In the above example, we are looking at the 2nd’s information. Other flags can be used with the -f flag
to get a more refined search.
In addition to choosing a different day, sar allows for starting or ending output at times other than the defaults. The -s flag
sets a new start time other than midnight and -e sets a new end time other than the current time. Both flags are HH:MM:SS format. If we wanted to view the CPU usage of the server from 9am to 10:30am we would use the following command.
[root@host] ~ >> sar -s 09:00:00 -e 10:30:00
09:00:01 AM CPU %user %nice %system %iowait %steal %idle
09:10:01 AM all 0.22 0.01 0.09 0.06 0.00 99.62
09:20:01 AM all 0.13 0.01 0.07 0.06 0.00 99.73
09:30:01 AM all 0.12 0.01 0.07 0.02 0.00 99.76
09:40:01 AM all 0.13 0.01 0.07 0.03 0.00 99.76
09:50:01 AM all 0.13 0.01 0.07 0.02 0.00 99.77
10:00:01 AM all 0.13 0.01 0.07 0.05 0.00 99.73
10:10:01 AM all 0.23 0.01 0.09 0.04 0.00 99.63
10:20:01 AM all 0.13 0.02 0.08 0.03 0.00 99.75
Average: all 0.15 0.01 0.08 0.04 0.00 99.72
Sar is a useful tool for monitoring and analyzing server resource usage. The amount of information it can provide can be overwhelming. With the right flags sar can help track down potential resource usage problems before they cause a disaster.
Liquid Web’s Heroic Support is always available to assist customers with this or any other issue. If you need our assistance please contact us:
Toll Free 1.800.580.4985