SAR - Monitoring Tool

Introduction:

Sar basically used for monitoring the performance of Linux/Unix based system. Sar generate the stats for the CPU usage, RAM usage and load average of the server and stores them in a file at regular interval. sar collects and displays ALL system activities statistics.By default, the command without an option displays CPU stats of the current day.

                                 Sar is part of the sysstat package. Linux distributions provide sar through the sysstat package.

Note:

SAR stores its output to the /var/adm/sa/sadd file, where the dd parameter indicates the current day.

Synatx of sar command is:

sar [-flags] [ -e time ] [ -f filename ] [-i sec ] [ -s time ]

-f  ---   filename uses filename as the data source for sar . Default is the current daily data file /var/adm/sa/sadd. 
-e ---   time Selects data up to time . Default is 18:00.
-i  ---   sec Selects data at intervals as close as possible to sec seconds.

flags:

-a	Report use of file access system routines: iget/s, namei/s, dirblk/s
-A	Report all data. Equivalent to -abcdgkmpqruvwy.
-b	Report buffer activity:bread/s, bwrit/s transfers per second of data between system buffers and disk or other block devices. lread/s, lwrit/s accesses of system buffers. %rcache, %wcache cache hit ratios, that is, (1-bread/lread) as a percentage. pread/s, pwrit/s transfers using raw (physical) device mechanism.
-c	Report system calls:scall/s system calls of all types. sread/s, swrit/s, fork/s, exec/s specific system calls. rchar/s, wchar/s characters transferred by read and write system calls. No incoming or outgoing exec and fork calls are reported.
-d	Report activity for each block device (for example, disk or tape drive) with the exception of XDC disks and tape drives. When data is displayed, the device specification dsk- is generally used to represent a disk drive. The device specification used to represent a tape drive is machine dependent. The activity data reported is: %busy, avque portion of time device was busy servicing a transfer request, average number of requests outstanding during that time. read/s, write/s, blks/s number of read/write transfers from or to device, number of bytes transferred in 512-byte units. avwait average wait time in milliseconds. avserv average service time in milliseconds.
-g	Report paging activities:pgout/s page-out requests per second. ppgout/s pages paged-out per second. pgfree/s pages per second placed on the free list by the page stealing daemon. pgscan/s pages per second scanned by the page stealing daemon. %ufs_ipf the percentage of UFS inodes taken off the freelist by iget which had reusable pages associated with them. These pages are flushed and cannot be reclaimed by processes. Thus, this is the percentage of igets with page flushes.
-k	Report kernel memory allocation (KMA) activities:sml_mem, alloc, fail information about the memory pool reserving and allocating space for small requests: the amount of memory in bytes KMA has for the small pool, the number of bytes allocated to satisfy requests for small amounts of memory, and the number of requests for small amounts of memory that were not satisfied (failed). lg_mem, alloc, fail information for the large memory pool (analogous to the information for the small memory pool). ovsz_alloc, fail the amount of memory allocated for oversize requests and the number of oversize requests which could not be satisfied (because oversized memory is allocated dynamically, there is not a pool).
-m	Report message and semaphore activities:msg/s, sema/s primitives per second.
-p	Report paging activities:atch/s page faults per second that are satisfied by reclaiming a page currently in memory (attaches per second). pgin/s page-in requests per second. ppgin/s  pages paged-in per second. pflt/s page faults from protection errors per second (illegal access to page) or "copy-on-writes". vflt/s address translation page faults per second (valid page not in memory). slock/s faults per second caused by software lock requests requiring physical I/O.
-q	Report average queue length while occupied, and percent of time occupied:runq-sz, %runocc run queue of processes in memory and runnable. swpq-sz, %swpocc these are no longer reported by sar .
-r	Report unused memory pages and disk blocks:freemem average pages available to user processes. freeswap disk blocks available for page swapping.
-u	Report CPU utilization (the default):%usr, %sys, %wio, %idle portion of time running in user mode, running in system mode, idle with some process waiting for block I/O, and otherwise idle.
-v	Report status of process, i-node, file tables: proc-sz, inod-sz, file-sz, lock-sz entries/size for each table, evaluatedov overflows that occur between sampling points for each table.
-w	Report system swapping and switching activity:swpin/s, swpot/s, bswin/s, bswot/s number of transfers and number of 512-byte units transferred for swapins and swapouts (including initial loading of some programs). pswch/s process switches.
-y	Report TTY device activity: rawch/s, canch/s, outch/s input character rate, input character rate processed by canon, output character rate.rcvin/s, xmtin/s, mdmin/s receive, transmit and modem interrupt rates.
-o filename	Save samples in file, filename, in binary format.
-e time	Select data up to time . Default is 18:00.
-f filename	Use filename as the data source for sar . Default is the current daily data file /var/adm/sa/sadd.
-i sec	Select data at intervals as close as possible to sec seconds.