sar Command
Advanced Performance & Debugging man(1)Collect, report, and save system activity information
👁 12 views
📅 Updated: Mar 15, 2026
SYNTAX
sar [OPTION]... [INTERVAL [COUNT]]
What Does sar Do?
sar (System Activity Reporter) collects, reports, and saves system activity information. It provides historical performance data for CPU, memory, I/O, network, and other resources.
sar is unique because it collects data continuously via a cron job, allowing you to review historical performance. This is invaluable for diagnosing issues that occurred in the past — "what happened at 3am?"
sar is part of the sysstat package. The sa1 cron job collects data every 10 minutes, and sa2 creates daily reports. Data is stored in /var/log/sysstat/ or /var/log/sa/.
sar is unique because it collects data continuously via a cron job, allowing you to review historical performance. This is invaluable for diagnosing issues that occurred in the past — "what happened at 3am?"
sar is part of the sysstat package. The sa1 cron job collects data every 10 minutes, and sa2 creates daily reports. Data is stored in /var/log/sysstat/ or /var/log/sa/.
Options & Flags
| Option | Description | Example |
|---|---|---|
| -u | CPU utilization | sar -u 1 5 |
| -r | Memory utilization | sar -r 1 5 |
| -b | I/O statistics | sar -b 1 5 |
| -n DEV | Network statistics | sar -n DEV 1 5 |
| -q | Queue length and load averages | sar -q 1 5 |
| -d | Disk activity | sar -d 1 5 |
| -f | Read from historical file | sar -u -f /var/log/sysstat/sa15 |
Practical Examples
#1 CPU usage
Shows CPU usage every second for 5 samples.
$ sar -u 1 5
Output:
%user %nice %system %iowait %idle\n 10.5 0.0 2.3 1.2 86.0
#2 Memory usage
Shows memory usage statistics.
$ sar -r 1 5#3 Network traffic
Shows network interface traffic per second.
$ sar -n DEV 1 5#4 Historical data
Shows CPU data from the 15th of the month.
$ sar -u -f /var/log/sysstat/sa15#5 Disk I/O
Shows disk activity per device.
$ sar -d 1 5#6 Yesterday report
Shows yesterday's CPU data.
$ sar -u -f /var/log/sysstat/sa$(date -d yesterday +%d)Tips & Best Practices
Enable data collection: Install sysstat and enable the service: sudo systemctl enable --now sysstat. Data collection starts automatically.
Historical analysis: sar -f /var/log/sysstat/saDD reads historical data. DD is the day of month. Essential for "what happened last night?" analysis.
Must be installed and enabled: sar requires sysstat package AND the sysstat service running for data collection.
Frequently Asked Questions
How do I check historical performance?
sar -u -f /var/log/sysstat/saDD where DD is the day. Shows CPU, memory, I/O for any past day with collected data.
How do I install sar?
sudo apt install sysstat && sudo systemctl enable --now sysstat. Edit /etc/default/sysstat to enable collection.
What metrics does sar track?
CPU (-u), memory (-r), disk I/O (-d), network (-n), load (-q), swap (-S), and more.
Related Commands
More Performance & Debugging Commands
Master Linux with Professional eBooks
Curated IT eBooks covering Linux, DevOps, Cloud, and more
Browse Books →