Linux Performance Monitoring with SAR (System Activity Reporter)

System Activity Reporter (SAR) is a vital performance monitoring tool available on most Linux systems. It collects, records, and reports system activity data over time — including CPU usage, memory load, disk I/O, and network performance.

⚠️ Note: SAR is not enabled by default on many distributions — it becomes available after installing the sysstat package.

This tutorial will walk you through installing SAR, using it interactively, interpreting its output, and identifying potential performance bottlenecks.

Monitoring Disk I/O with sar -b or sar -d

Disk performance is a common bottleneck in server environments. SAR helps you analyze block device I/O.

⚠️ Note: sar -b shows aggregated block I/O for the system. For per-device analysis, use sar -d.

Block I/O Summary

sar -b 1 1

Example output:

12:00:01 AM tps   rtps  wtps  bread/s  bwrtn/s

             5.0   2.0   3.0    1024    2048

⚠️ SMART note: bread/s and bwrtn/s represent blocks per second, not kilobytes. Block size depends on the kernel (commonly 512 bytes or 1 KB).

Device-Level I/O

sar -d 1 1

Use this to monitor individual devices (e.g. sda, nvme0n1). For NVMe drives, device names may vary (e.g., nvme0n1, nvme0c1n1). SAR displays only devices supported by the sysstat backend.

Installing SAR on Linux

Debian/Ubuntu:

sudo apt update

sudo apt install sysstat

RHEL/CentOS/Fedora:

sudo yum install sysstat

Enable sysstat service:

sudo systemctl enable --now sysstat

Check SAR version:

sar -V

⚠️ Note: On some systems (e.g., Ubuntu 22.04+), historical logging is disabled by default in /etc/default/sysstat. Set ENABLED=”true” to activate data collection.

Monitoring CPU Performance with SAR

To monitor CPU usage, run:

sar -u 1 1

Example output:

12:00:01 AM  CPU     %user   %nice   %system  %iowait  %steal   %idle
12:10:01 AM  all     7.00    0.00    2.50     0.50     0.00     90.00

💡 Tip: Use sar -P ALL to view per-core CPU usage, which is often critical when diagnosing multi-core saturation.

Each column shows how CPU time is allocated:

❗️ Important: High %iowait means the CPU is waiting on I/O, but the root cause may be disk, network storage, NFS, Ceph, or any blocked I/O operation.

💡 Tip: Watch for a combination of low %idle and elevated %iowait — this strongly suggests I/O pressure.

Time CPU is idle. Low + high %user/%system = possible CPU saturation. |

⚠️ If %iowait is consistently > 5–10%, consider checking your disk performance.

Monitoring Memory and Network with SAR

Monitoring Memory Usage with sar -r

sar -r 1 1

Example output:

12:10:01 AM kbmemfree kbmemused  %memused

             204800   1835008     89.00

⚠️ Note: kbmemused includes page cache and buffers, which is normal on Linux and not necessarily an indicator of memory pressure.

Monitoring Network I/O with sar -n DEV

sar -n DEV 1 1

Example output:

12:10:01 AM IFACE  rxpck/s  txpck/s  rxkB/s  txkB/s

             eth0    120.00   100.00   320.00  256.00

Values are shown in kibibytes (KiB/s), not kilobytes (kB/s). This is the default behavior of sysstat.

SAR Command Reference

A list of commonly used SAR flags:

❗️ Warning: sar -A produces extremely large output on busy systems — use with care.

Accessing Historical Data with SAR

By default, SAR logs are stored in /var/log/sa/ with filenames like sa13 (for the 13th day of the month).

⚠️ Note:  sysstat stores binary logs as saDD and daily reports as sarDD; naming may vary slightly across distributions.

View logs from a specific day:

sar -f /var/log/sa/sa13

View data from a specific time range:

sar -u -s 08:00:00 -e 10:00:00

Filtering by -s/-e works only for timestamps that were actually recorded by the sysstat collector.

Common Usage Scenarios for SAR

For a full health snapshot, consider adding -b to include block device I/O statistics.

Conclusion

SAR is a lightweight yet powerful performance profiling tool built into nearly every Linux distribution. SAR has minimal performance overhead, making it suitable for production systems. With simple commands like sar -u, sar -r, and sar -n DEV, you can pinpoint CPU, memory, and network anomalies in seconds.

Regularly using SAR helps Linux administrators catch performance degradation early and tune systems proactively.

FAQs