Introduction
When monitoring Linux server performance, it’s crucial not just to check the system’s current state but also to identify when high load occurs. The sar (System Activity Reporter) command is a powerful tool for this, allowing you to regularly record and analyze key system metrics such as CPU usage, memory consumption, disk I/O, and network traffic.
In this article, I cover the basics of the sar command, how to configure the sysstat package, and practical examples of using sar for troubleshooting and performance analysis.
Information Collected by sar
When performance-related issues occur, you can check the real-time resource status using commands like top, but it’s not possible to investigate past resource spikes such as temporary CPU or memory surges. This is where sar becomes useful.
sar automatically collects system activity data at regular intervals, recording metrics such as CPU usage, memory, I/O, and network over time. These records are usually stored as daily files (e.g., sa24) under the /var/log/sa/ directory. By default, sar collects data at 10-minute intervals.
I will explain the types of information that can be monitored with sar, based on what can be collected in sysstat version 12.5.
CPU Usage
Recent CPU Usage
You can use the sar -u command to obtain the overall CPU usage across all CPU cores.
[root@quiz ~]# sar -u
Linux 5.14.0-570.19.1.el9_6.x86_64 (quiz.eeengineer.com) 10/25/2025 _x86_64_ (4 CPU)
12:00:01 AM CPU %user %nice %system %iowait %steal %idle
12:10:00 AM all 0.17 0.00 0.17 0.01 0.00 99.65
12:20:01 AM all 0.13 0.00 0.14 0.01 0.00 99.72
12:30:01 AM all 0.14 0.02 0.15 0.03 0.00 99.65
12:40:02 AM all 0.13 0.00 0.12 0.01 0.00 99.74
12:50:02 AM all 0.15 0.00 0.14 0.01 0.00 99.71
01:00:02 AM all 0.13 0.00 0.13 0.01 0.00 99.73- %user
The percentage of CPU used by user processes (applications). Normal application CPU usage is mainly reflected in this value. - %nice
The percentage of CPU used by user processes running with a modified priority (nice value). A high value may indicate heavy background processing.。 - %system
The percentage of CPU used in kernel space (system calls), including file I/O, network processing, and interrupt handling. - %iowait
The percentage of time the CPU spends waiting for I/O (such as disk or network) to complete. A high value may indicate issues with storage performance or I/O scheduling. - %steal
In a virtualized environment, the percentage of CPU time used by other virtual machines. A high value may indicate insufficient CPU resources on the host. Generally, %steal does not occur unless overcommitment is enabled.
(Note) Overcommitment: Allocating more virtual resources (CPU or memory) than the actual physical resources available. - %idle
The percentage of time the CPU is idle (not performing any tasks). CPU usage can be calculated as shown below, so first, check this value.
CPU Usage (%) = 100 – %idle
CPU Usage on Previous Days
By specifying a sar file, you can also check CPU usage for previous days.
Running the following command allows you to view the data for the 25th.
[root@quiz ~]# sar -u -f /var/log/sa/sa25
Linux 5.14.0-570.19.1.el9_6.x86_64 (quiz.eeengineer.com) 10/25/2025 _x86_64_ (4 CPU)
12:00:01 AM CPU %user %nice %system %iowait %steal %idle
12:10:00 AM all 0.17 0.00 0.17 0.01 0.00 99.65
12:20:01 AM all 0.13 0.00 0.14 0.01 0.00 99.72
12:30:01 AM all 0.14 0.02 0.15 0.03 0.00 99.65
12:40:02 AM all 0.13 0.00 0.12 0.01 0.00 99.74
12:50:02 AM all 0.15 0.00 0.14 0.01 0.00 99.71
01:00:02 AM all 0.13 0.00 0.13 0.01 0.00 99.73Real-Time CPU Usage
Using the sar command, it is also possible to monitor CPU usage in real time. By shortening the data collection interval, you can perform a more detailed analysis.
As an example, below is the result of collecting CPU-related information every second for 10 times.
[root@quiz ~]# sar -u 1 10
Linux 5.14.0-570.19.1.el9_6.x86_64 (quiz.eeengineer.com) 10/25/2025 _x86_64_ (4 CPU)
10:35:59 PM CPU %user %nice %system %iowait %steal %idle
10:36:00 PM all 0.00 0.00 0.25 0.00 0.00 99.75
10:36:01 PM all 0.00 0.00 0.25 0.00 0.00 99.75
10:36:02 PM all 0.00 0.00 0.00 0.00 0.00 100.00
10:36:03 PM all 0.00 0.00 0.50 0.00 0.00 99.50
10:36:04 PM all 0.00 0.00 0.25 0.00 0.00 99.75
10:36:05 PM all 0.00 0.00 0.00 0.00 0.00 100.00
10:36:06 PM all 0.25 0.00 0.00 0.00 0.00 99.75
10:36:07 PM all 0.00 0.00 0.00 0.00 0.00 100.00
10:36:08 PM all 0.25 0.00 0.25 0.00 0.00 99.50
10:36:09 PM all 0.00 0.00 0.25 0.00 0.00 99.75
Average: all 0.05 0.00 0.18 0.00 0.00 99.77
[root@quiz ~]#CPU Usage per Core
By running the sar -P ALL command, you can obtain the CPU usage for each individual core. This allows you to check, for example, whether the load is unevenly distributed across specific cores.
[root@quiz ~]# sar -P ALL
Linux 5.14.0-570.19.1.el9_6.x86_64 (quiz.eeengineer.com) 10/25/2025 _x86_64_ (4 CPU)
12:00:01 AM CPU %user %nice %system %iowait %steal %idle
12:10:00 AM all 0.17 0.00 0.17 0.01 0.00 99.65
12:10:00 AM 0 0.16 0.00 0.16 0.01 0.00 99.67
12:10:00 AM 1 0.17 0.00 0.16 0.01 0.00 99.65
12:10:00 AM 2 0.18 0.00 0.18 0.01 0.00 99.63
12:10:00 AM 3 0.17 0.01 0.17 0.02 0.00 99.64
12:10:00 AM CPU %user %nice %system %iowait %steal %idle
12:20:01 AM all 0.13 0.00 0.14 0.01 0.00 99.72
12:20:01 AM 0 0.13 0.00 0.13 0.00 0.00 99.74
12:20:01 AM 1 0.13 0.00 0.15 0.01 0.00 99.70
12:20:01 AM 2 0.14 0.00 0.13 0.01 0.00 99.72
12:20:01 AM 3 0.14 0.00 0.13 0.01 0.00 99.72Memory Usage
Recent Memory Usage
You can check memory usage by running the sar -r command.
[root@quiz ~]# sar -r
Linux 5.14.0-570.19.1.el9_6.x86_64 (quiz.eeengineer.com) 10/25/2025 _x86_64_ (4 CPU)
12:00:01 AM kbmemfree kbavail kbmemused %memused kbbuffers kbcached kbcommit %commit kbactive kbinact kbdirty
12:10:00 AM 2705276 2643628 789396 21.09 7132 182664 4760420 127.19 843148 15296 76
12:20:01 AM 2706400 2645520 786740 21.02 8440 182856 4760424 127.19 843180 16788 80
12:30:01 AM 2713580 2647868 789064 21.08 3716 178204 4760240 127.18 839680 10584 92
12:40:02 AM 2710588 2646392 789180 21.08 4620 180172 4759880 127.17 841300 11692 24
12:50:02 AM 2709444 2645756 789280 21.09 5408 180376 4758212 127.13 840904 12680 44
01:00:02 AM 2709976 2646812 787708 21.05 6168 180632 4757288 127.10 840004 13612 76- kbmemfree
Amount of free memory (in kB). Indicates the portion of memory that is completely unused. - kbavail
Amount of available memory (in kB). - kbmemused
Amount of used memory (in kB). - %memused
Memory usage rate, calculated as:
%memused = kbmemused / (kbmemused + kbmemfree) × 100
Note: This includes reusable buffers and cache, so a high value does not necessarily indicate a problem. Instead, check the following usage rate that takes kbavail into account.
Actual Memory Usage (%) = (1 – kbavail / (kbmemfree + kbmemused)) × 100 - kbbuffers
Amount of memory (in kB) used by the kernel as buffers. This memory is used for disk block I/O buffering and caching file system metadata (such as inodes and directory information). - kbcached
Amount of memory (in kB) used by the kernel as cache (page cache or file cache). This area stores data read from the file system and data that may be reused in the future. - %commit
Percentage of committed memory (the total amount of memory the OS has promised to allocate) relative to the sum of physical memory and swap space. When this value exceeds 100%, the system is in an overcommit state, which poses a risk of resource shortage. - kbactive
Amount of active memory (frequently used areas). These regions are recently accessed and are less likely to be swapped out. - kbinact
Amount of inactive memory (areas not used for a while). These can be swapped out if necessary. - kbdirty
Amount of data (in kB) waiting to be written to disk (unflushed pages). - If this value continues to increase, it may indicate I/O delays or a disk bottleneck.
Just like CPU statistics, both real-time and historical data can be obtained.
Swap Usage
You can check swap usage by running the sar -S command.
[root@quiz ~]# sar -S
Linux 5.14.0-570.19.1.el9_6.x86_64 (quiz.eeengineer.com) 2025-10-26 _x86_64_ (4 CPU)
12:00:01 AM kbswpfree kbswpused %swpused kbswpcad %swpcad
12:00:11 AM 2097148 1024 0.05 512 50.00
12:00:21 AM 2096124 2048 0.10 1024 50.00
12:00:31 AM 2096124 2048 0.10 1024 50.00
Average: 2096465 1700 0.08 853 50.00- kbswpfree
Amount of unused swap space (in kB). - kbswpused
Amount of swap space currently in use (in kB). - %swpused
Swap usage rate = (kbswpused / (kbswpfree + kbswpused)) × 100 - kbswpcad
Amount of cached swap space (in kB). - %swpcad
Cached swap ratio = (kbswpcad / kbswpused) × 100
Disk I/O
You can obtain disk I/O-related information by running the sar -d command.
[root@quiz ~]# sar -d
Linux 5.14.0-570.19.1.el9_6.x86_64 (quiz.eeengineer.com) 10/26/2025 _x86_64_ (4 CPU)
12:00:01 AM DEV tps rkB/s wkB/s dkB/s areq-sz aqu-sz await %util
12:10:05 AM sda 1.41 13.14 6.11 0.00 13.61 0.00 3.13 0.30
12:20:06 AM sda 1.01 0.00 7.24 0.00 7.18 0.00 0.86 0.04
12:30:02 AM sda 1.65 15.50 7.62 0.00 14.01 0.00 0.80 0.07
12:40:07 AM sda 5.69 220.58 8.65 0.00 40.31 0.00 0.67 0.27
12:50:08 AM sda 1.26 0.01 9.93 0.00 7.88 0.00 0.80 0.03
01:00:09 AM sda 1.01 0.01 8.83 0.00 8.74 0.00 0.88 0.04- DEV
Device name. - tps
Number of I/O transactions per second. Represents the total number of I/O requests (both read and write) completed per second. - rkB/s
Read speed (read KB per second). Amount of data read from the disk per second (in kB). - wkB/s
Write speed (write KB per second). Amount of data written to the disk per second (in kB). - dkB/s
An older kernel metric. In RHEL 9, this value is typically fixed at 0. - areq-sz
Average request size (in kB). The average amount of data processed per I/O request. - aqu-sz
Average queue size. Represents the average number of I/O requests waiting in the queue. A high value may indicate disk queue congestion. - await
Average I/O wait time (in milliseconds). The average time from when an I/O request is issued until it completes. A high value may indicate I/O latency. - %util
Device utilization rate. The percentage of time the device was busy handling I/O requests. A value close to 100% suggests a potential I/O bottleneck.
As with CPU and memory, you can obtain both real-time and historical data
Network
You can check network interface communication status by running the sar -n DEV command.
[root@quiz ~]# sar -n DEV
Linux 5.14.0-570.19.1.el9_6.x86_64 (quiz.eeengineer.com) 10/28/2025 _x86_64_ (4 CPU)
12:00:01 AM IFACE rxpck/s txpck/s rxkB/s txkB/s rxcmp/s txcmp/s rxmcst/s %ifutil
12:10:00 AM lo 0.06 0.06 0.03 0.03 0.00 0.00 0.00 0.00
12:10:00 AM eth0 3.49 3.28 0.51 0.67 0.00 0.00 0.00 0.00
12:20:01 AM lo 0.36 0.36 0.07 0.07 0.00 0.00 0.00 0.00- IFACE
Indicates the network interface being monitored. - rxpck/s
Number of received packets per second. If this value is too high, packet reception processing may contribute to increased CPU load. - txpck/s
Number of transmitted packets per second. Useful for understanding the communication frequency of applications or clients. - rxkB/s
Amount of data received per second (in kB), representing the network receive throughput. - If this value remains high, it may be necessary to check for receive bandwidth saturation.
- txkB/s
Amount of data sent per second (in kB), representing the network transmit throughput. - Continuous large transmissions can cause network load issues.
- rxcmp/s
Number of compressed packets received per second. Used only on interfaces that support compressed transfers; usually always 0. - txcmp/s
Number of compressed packets sent per second. Used only on interfaces that support compressed transfers; usually always 0. - rxmcst/s
Number of multicast packets received per second. This value increases when multicast communication (e.g., monitoring or distribution traffic) occurs within the network. - %ifutil
Interface utilization rate (bandwidth usage). Indicates how much of the theoretical bandwidth of the network card is being used (%). A high value may suggest insufficient bandwidth.
As with CPU, memory, and disk I/O, you can obtain both real-time and historical data.
sysstat Configuration
This section explains how to install and configure sysstat to collect data using the sar command. The following steps apply to RHEL 9 and AlmaLinux 9.
Installing sysstat
Install sysstat using the dnf command. In this example, sysstat 12.5 is installed.
[root@quiz ~]# dnf install -y sysstat
Last metadata expiration check: 0:22:53 ago on Fri 24 Oct 2025 06:30:32 AM JST.
Dependencies resolved.
=========================================================================================================================================================================================================================================
Package Architecture Version Repository Size
=========================================================================================================================================================================================================================================
Installing:
sysstat x86_64 12.5.4-9.el9 appstream 465 k
Installing dependencies:
avahi-libs x86_64 0.8-22.el9_6.1 baseos 66 k
libuv x86_64 1:1.42.0-2.el9_4 appstream 146 k
lm_sensors-libs x86_64 3.6.0-10.el9 appstream 41 k
pcp-conf x86_64 6.3.7-1.el9_6 appstream 31 k
pcp-libs x86_64 6.3.7-1.el9_6 appstream 644 k
Transaction Summary
=========================================================================================================================================================================================================================================
Install 6 Packages
Total download size: 1.4 M
Installed size: 3.8 M
Downloading Packages:
(1/6): libuv-1.42.0-2.el9_4.x86_64.rpm 1.4 MB/s | 146 kB 00:00
(2/6): pcp-conf-6.3.7-1.el9_6.x86_64.rpm 291 kB/s | 31 kB 00:00
~~Omitted~~ 4/6
Verifying : sysstat-12.5.4-9.el9.x86_64 5/6
Verifying : avahi-libs-0.8-22.el9_6.1.x86_64 6/6
Installed:
avahi-libs-0.8-22.el9_6.1.x86_64 libuv-1:1.42.0-2.el9_4.x86_64 lm_sensors-libs-3.6.0-10.el9.x86_64 pcp-conf-6.3.7-1.el9_6.x86_64 pcp-libs-6.3.7-1.el9_6.x86_64 sysstat-12.5.4-9.el9.x86_64
Complete!
[root@quiz ~]#
[root@quiz ~]# rpm -q sysstat
sysstat-12.5.4-9.el9.x86_64
[root@quiz ~]#
Enabling Automatic Data Collection
Run the following command to enable and start a systemd timer that automates data collection for the sar command. By enabling the systemd timer, data accessible via sar is automatically saved every 10 minutes by default, and the files (saXX) are stored under /var/log/sa.
[root@quiz ~]# systemctl enable --now sysstat-collect.timer
[root@quiz ~]#
[root@quiz ~]# systemctl status sysstat-collect.timer
● sysstat-collect.timer - Run system activity accounting tool every 10 minutes
Loaded: loaded (/usr/lib/systemd/system/sysstat-collect.timer; enabled; preset: disabled)
Active: active (waiting) since Fri 2025-10-24 06:54:50 JST; 11s ago
Until: Fri 2025-10-24 06:54:50 JST; 11s ago
Trigger: Fri 2025-10-24 07:00:00 JST; 4min 57s left
Triggers: ● sysstat-collect.service
Oct 24 06:54:50 quiz.eeengineer.com systemd[1]: Started Run system activity accounting tool every 10 minutes.
[root@quiz ~]#
Next, run the following command to enable and start a script that aggregates the data collected by the sar command. This script runs shortly after midnight, creating sarX files under /var/log/sa. These files are plain text, so you can view their contents using commands like cat or view.
[root@quiz ~]# systemctl enable --now sysstat-summary.timer
[root@quiz ~]#
[root@quiz ~]# systemctl status sysstat-summary.timer
● sysstat-summary.timer - Generate summary of yesterday's process accounting
Loaded: loaded (/usr/lib/systemd/system/sysstat-summary.timer; enabled; preset: disabled)
Active: active (waiting) since Fri 2025-10-24 06:54:54 JST; 12s ago
Until: Fri 2025-10-24 06:54:54 JST; 12s ago
Trigger: Sat 2025-10-25 00:07:00 JST; 17h left
Triggers: ● sysstat-summary.service
Oct 24 06:54:54 quiz.eeengineer.com systemd[1]: Started Generate summary of yesterday's process accounting.
[root@quiz ~]#
Changing the Data Collection Interval
The default setting for sysstat-collector.timer is as follows, with a data collection interval of 10 minutes. You can adjust the interval in the [Timer] section.
[root@quiz ~]# systemctl cat sysstat-collect.timer
# /usr/lib/systemd/system/sysstat-collect.timer
# /usr/lib/systemd/system/sysstat-collect.timer
# (C) 2014 Tomasz Torcz <tomek@pipebreaker.pl>
#
# sysstat-12.5.4 systemd unit file:
# Activates activity collector every 10 minutes
[Unit]
Description=Run system activity accounting tool every 10 minutes
[Timer]
OnCalendar=*:00/10
[Install]
WantedBy=sysstat.service
[root@quiz ~]#
Here, let’s change the data collection interval to 1 minute.
First, create a directory and then create an override configuration file named override.conf.
After resetting the default settings with OnCalendar=, set OnCalendar=*:00/1 to change the data collection interval to 1 minute.
[root@quiz ~]# mkdir -p /etc/systemd/system/sysstat-collect.timer.d
[root@quiz ~]#
[root@quiz ~]# vi /etc/systemd/system/sysstat-collect.timer.d/override.conf
[root@quiz ~]# cat /etc/systemd/system/sysstat-collect.timer.d/override.conf
[Timer]
OnCalendar=
OnCalendar=*:00/1
[root@quiz ~]#
Next, apply the newly added settings.
[root@quiz ~]# systemctl daemon-reload
[root@quiz ~]# systemctl restart sysstat-collect.timer
[root@quiz ~]# systemctl cat sysstat-collect.timer
# /usr/lib/systemd/system/sysstat-collect.timer
# /usr/lib/systemd/system/sysstat-collect.timer
# (C) 2014 Tomasz Torcz <tomek@pipebreaker.pl>
#
# sysstat-12.5.4 systemd unit file:
# Activates activity collector every 10 minutes
[Unit]
Description=Run system activity accounting tool every 10 minutes
[Timer]
OnCalendar=*:00/10
[Install]
WantedBy=sysstat.service
# /etc/systemd/system/sysstat-collect.timer.d/override.conf
[Timer]
OnCalendar=
OnCalendar=*:00/1
[root@quiz ~]#
[root@quiz ~]# systemctl list-timers sysstat-collect.timer
NEXT LEFT LAST PASSED UNIT ACTIVATES
Wed 2025-10-29 06:07:00 JST 27s left Wed 2025-10-29 06:06:05 JST 26s ago sysstat-collect.timer sysstat-collect.service
1 timers listed.
Pass --all to see loaded but inactive timers, too.
[root@quiz ~]#
If the NEXT time is 1 minute after the LAST time as shown below, the settings have been applied correctly.
[root@quiz ~]# systemctl list-timers sysstat-collect.timer
NEXT LEFT LAST PASSED UNIT ACTIVATES
Wed 2025-10-29 06:07:00 JST 27s left Wed 2025-10-29 06:06:05 JST 26s ago sysstat-collect.timer sysstat-collect.service
1 timers listed.
Pass --all to see loaded but inactive timers, too.
[root@quiz ~]#Let’s check the actual collected data. You should see that, from a certain point onward, resources have been recorded at 1-minute intervals.
[root@quiz ~]# sar -f /var/log/sa/sa29
Linux 5.14.0-570.19.1.el9_6.x86_64 (quiz.eeengineer.com) 10/29/2025 _x86_64_ (4 CPU)
12:00:03 AM CPU %user %nice %system %iowait %steal %idle
12:10:03 AM all 0.24 0.08 0.21 0.05 0.00 99.42
12:20:00 AM all 0.29 0.00 0.19 0.01 0.00 99.51
12:30:02 AM all 0.31 0.00 0.20 0.02 0.00 99.48
~~Omitted~~
05:10:07 AM all 0.04 0.00 0.06 0.00 0.00 99.89
05:20:03 AM all 0.06 0.00 0.06 0.00 0.00 99.88
05:30:08 AM all 0.06 0.00 0.07 0.01 0.00 99.87
05:40:09 AM all 0.04 0.00 0.05 0.00 0.00 99.90
05:50:03 AM all 0.05 0.02 0.07 0.02 0.00 99.84
06:00:00 AM all 0.13 0.00 0.13 0.02 0.00 99.72
06:06:01 AM all 0.09 0.00 0.09 0.01 0.00 99.82
06:06:05 AM all 0.16 0.00 0.21 0.00 0.00 99.63
06:07:01 AM all 0.05 0.00 0.06 0.00 0.00 99.89
06:08:01 AM all 0.04 0.00 0.07 0.00 0.00 99.88
06:09:01 AM all 0.07 0.00 0.08 0.00 0.00 99.85
06:10:01 AM all 0.04 0.00 0.07 0.00 0.00 99.89
[root@quiz ~]#Changing the Data Retention Period
By default, sar files are retained for 28 days. Edit the HISTORY value in the sysstat configuration file as shown below. In this example, it is set to 14 days.
[root@quiz ~]# vi /etc/sysconfig/sysstat
[root@quiz ~]# grep HISTORY /etc/sysconfig/sysstat
HISTORY=14
[root@quiz ~]#Load the updated configuration and restart the service.
[root@quiz ~]# systemctl daemon-reexec
[root@quiz ~]# systemctl restart sysstat-collect.timer
[root@quiz ~]# systemctl status sysstat-collect.timer
● sysstat-collect.timer - Run system activity accounting tool every 10 minutes
Loaded: loaded (/usr/lib/systemd/system/sysstat-collect.timer; enabled; preset: disabled)
Drop-In: /etc/systemd/system/sysstat-collect.timer.d
└─override.conf
Active: active (waiting) since Wed 2025-10-29 06:45:25 JST; 14s ago
Until: Wed 2025-10-29 06:45:25 JST; 14s ago
Trigger: Wed 2025-10-29 06:46:00 JST; 20s left
Triggers: ● sysstat-collect.service
Oct 29 06:45:25 quiz.eeengineer.com systemd[1]: Stopping Run system activity accounting tool every 10 minutes...
Oct 29 06:45:25 quiz.eeengineer.com systemd[1]: Started Run system activity accounting tool every 10 minutes.
[root@quiz ~]#
[root@quiz ~]# systemctl restart sysstat-summary.timer
[root@quiz ~]# systemctl status sysstat-summary.timer
● sysstat-summary.timer - Generate summary of yesterday's process accounting
Loaded: loaded (/usr/lib/systemd/system/sysstat-summary.timer; enabled; preset: disabled)
Active: active (waiting) since Wed 2025-10-29 06:45:45 JST; 5s ago
Until: Wed 2025-10-29 06:45:45 JST; 5s ago
Trigger: Thu 2025-10-30 00:07:00 JST; 17h left
Triggers: ● sysstat-summary.service
Oct 29 06:45:45 quiz.eeengineer.com systemd[1]: Started Generate summary of yesterday's process accounting.
[root@quiz ~]#How to Visualize sar Data with kSar
Data collected with sar can be difficult to interpret when viewed as numbers alone. Here, we introduce a method to visualize the data using graphs. This guide explains how to use a tool called kSar.
kSar is a Java-based tool that visually graphs sar data collected from Linux/Unix systems. With kSar, you can easily visualize statistics for CPU, memory, disk I/O, network, and more using line graphs, bar charts, and other visual formats.
In this article, we explain how to download sar files collected on a Linux server to a Windows machine, and then use kSar on Windows to generate graphs.
Downloading kSar
Download the kSar .jar file from the following URL and save it to a suitable folder.
https://github.com/vlsi/ksar/releases
Running kSar
Open the Command Prompt and run the downloaded .jar file as follows.
Microsoft Windows [Version 10.0.26100.6899]
(c) Microsoft Corporation. All rights reserved.
C:\Users\user>cd C:\Users\user\Documents\kSar
C:\Users\user\Documents\kSar>
C:\Users\user\Documents\kSar>java -jar ksar-6.0.0.jar
08:34:59.944 [main] INFO net.atomique.ksar.Main - ksar Version : 6.0.0
08:34:59.955 [main] INFO net.atomique.ksar.Main - Java runtime Version : 17.0.2+8-86
08:34:59.955 [main] INFO net.atomique.ksar.Main - Java runtime architecture : amd64Note: To run kSar, you need Java version 17 or later, so make sure it is installed beforehand.
After launching, the kSar GUI should appear as shown below.
Graphing with kSar
Now, let’s visualize the sar file. Load the sar file created on the Linux server.
Click Data > Load from a file…
Specify the target sar file and click Open.
When the Date Format selection screen appears, click OK.
If the various resource items are displayed as shown below, the process was successful.
Clicking on any resource item will display its corresponding graph, as illustrated below.
By clicking the Export tab, you can also output the data as a PDF or CSV, making it very convenient.
Summary
In this article, we explained the basics and practical usage of the sar command, which is useful for performance monitoring on Linux servers. The key points are summarized below:
Role of sar:
Regularly records resource metrics such as CPU, memory, disk I/O, and network usage, and allows reviewing historical performance data.
How to check information:
- sar -u: CPU usage (overall, historical, real-time)
- sar -r: Memory usage,
sar -S: Swap usage - sar -d: Disk I/O,
sar -n DEV: Network statistics - sar -P ALL: View the load on each CPU core
sysstat configuration:
Install the sysstat package and enable automatic data collection and aggregation using a systemd timer. You can also adjust the collection interval and data retention period.
Data visualization:
Collected sar log files can be graphed using kSar, enabling visual analysis of CPU, memory, I/O, and network metrics.
By utilizing sar, it becomes easier to analyze historical resource usage, identify bottlenecks, and ensure stable Linux server operations.
English 
Japanese
コメント