Tools to monitor your Linux systems by command line – part three

In this last article about tools that you can use to monitor a server, we will talk about sysstat. The command sar, which is a tool included in sysstat package, shows a report about the past so you can analyze an incident that was reported a few hours or days ago.

sysstat – Collect, report, or save system activity information (from man sysstat).

Installation (on Ubuntu):

Sometimes a user calls you to report an incident that happened a few hours or days ago. So with iotop, top or htop you can’t see how your server was.

To resolve this issue, you can use sysstat that is a metrics collector and reporter about CPU, memory, disk, swap and others. By default, sysstat saves the indicators each ten minutes into one file every day and writes its contents to a standard output containing information since the computer was started.

You can see about CPU utilization by typing (all processors together):

• sar

To see statistics for each individual processor

• sar -P ALL

To see the report of a specific date use -f option:

• sar -f /var/log/sysstat/sa23

with ending time:

• sar -f /var/log/sysstat/sa23 -e 21:00:00

with starting time:

• sar -f /var/log/sysstat/sa23 -s 21:00:00

Report I/O transfer. You can see IOPS (read and write) called tps in sar command

• sar -b

Report activity for each block device (similar to sar -b)

• sar -d

Report activity for network devices (some metrics – number of packets and number of kilobytes per second)

• sar -n DEV

Report activity for network devices (to see statistics errors too – bad packets, errors that happened while transmitting packets, collisions, received and transmitted packets dropped)

• sar -n EDEV

Report queue length and load averages.

• sar -q (number of tasks waiting for run time, load average about last minute, for the past 5 minutes and 10 minutes).

Memory utilization:

• sar -r

Swap space utilization: 

• sar -S (shows the amount of free and used swap)

Report swapping statistics

• sar -W

To see sar in real time, type the command below to watch a live report for each 2 seconds repeated for ten times about the processor.

• sar -u 2 10

More information: man sar or man sysstat