sar (Unix)

sar (System Activity Reporter) is a command-line utility in Unix-like operating systems used for collecting, reporting, and saving system activity information. It's part of the sysstat package and is crucial for performance monitoring, capacity planning, and troubleshooting system issues.

Functionality:

sar gathers statistics on various system resources and activities, including:

• CPU Utilization: Reports CPU usage, including user, system, idle, and I/O wait times.
• Memory Utilization: Tracks memory usage, including used, free, cached, and buffered memory.
• Disk I/O: Monitors disk read and write activity, including transfers per second, kilobytes read/written per second, and average queue length.
• Network Activity: Collects statistics on network packet transmission and reception.
• Swap Space Utilization: Reports swap space usage.
• Interrupts: Records the number of interrupts handled by the system.
• Context Switches: Monitors the number of context switches performed by the CPU.
• Process Creation: Records the number of processes created per second.

Operation:

sar operates in two primary modes:

1. Real-time Monitoring: When invoked without specific arguments (or with specific intervals and counts), sar displays real-time system activity data on the terminal. This is useful for observing immediate performance trends.
2. Historical Data Reporting: sar can read data from historical data files (typically stored in /var/log/sa/) and generate reports based on that data. These files are created and updated by the sadc (System Activity Data Collector) utility, which is usually run automatically as a cron job. The sadc program regularly samples system activity and appends the data to these binary files.

Purpose:

The primary purpose of sar is to provide a comprehensive view of system performance over time. System administrators and performance engineers use sar data to:

• Identify performance bottlenecks.
• Analyze resource utilization trends.
• Plan for future capacity needs.
• Troubleshoot performance problems.
• Baseline system performance before and after changes.