linux 系统状态监控 ［sar］备忘

 SAR(1)                                                                        Linux User’s Manual                                                                       SAR(1)

NAME
       sar - Collect, report, or save system activity information.

SYNOPSIS
       sar  [  -A ] [ -b ] [ -B ] [ -c ] [ -d ] [ -H ] [ -h ] [ -i interval ] [ -p ] [ -q ] [ -r ] [ -R ] [ -t ] [ -u ] [ -v ] [ -V ] [ -w ] [ -W ] [ -y ] [ -n { DEV | EDEV |
       SOCK | FULL } ] [ -x { pid | SELF | ALL } ] [ -X { pid | SELF | ALL } ] [ -I { irq | SUM | ALL | XALL } ] [ -P { cpu | ALL } ] [ -o [ filename ] | -f [ filename ] ]  [
       -s [ hh:mm:ss ] ] [ -e [ hh:mm:ss ] ] [ interval [ count ] ]

DESCRIPTION
       The  sar command writes to standard output the contents of selected cumulative activity counters in the operating system. The accounting system, based on the values in
       the count and interval parameters, writes information the specified number of times spaced at the specified intervals in seconds.  If the interval parameter is set  to
       zero, the sar command displays the average statistics for the time since the system was started. The default value for the count parameter is 1. If its value is set to
       zero, then reports are generated continuously.  The collected data can also be saved in the file specified by the -o filename flag, in addition to being displayed onto
       the screen. If filename is omitted, sar uses the standard system activity daily data file, the /var/log/sa/sadd file, where the dd parameter indicates the current day.

       The sar command extracts and writes to standard output records previously saved in a file. This file can be either the one specified by the -f flag or, by default, the
       standard system activity daily data file.

       Without  the  -P  flag, the sar command reports system-wide (global among all processors) statistics, which are calculated as averages for values expressed as percent-
       ages, and as sums otherwise. If the -P flag is given, the sar command reports activity which relates to the specified processor or processors. If -P ALL is given,  the
       sar command reports statistics for each individual processor and global statistics among all processors.

       You  can  select information about specific system activities using flags. Not specifying any flags selects only CPU activity.  Specifying the -A flag is equivalent to
       specifying -bBcdqrRuvwWy -I SUM -n FULL -P ALL.

       The default version of the sar command (CPU utilization report) might be one of the first facilities the user runs to begin system activity investigation,  because  it
       monitors major system resources. If CPU utilization is near 100 percent (user + nice + system), the workload sampled is CPU-bound.

       If multiple samples and multiple reports are desired, it is convenient to specify an output file for the sar command.  Run the sar command as a background process. The
       syntax for this is:

       sar -o data.file interval count >/dev/null 2>&1 &

       All data is captured in binary form and saved to a file (data.file).  The data can then be selectively displayed with the sar command using  the  -f  option.  Set  the
       count  parameter  to select records at count second intervals. If this parameter is not set, all the records saved in the file will be selected.  Collection of data in
       this manner is useful to characterize system usage over a period of time and determine peak usage hours.

       Note:     The sar command only reports on local activities.

OPTIONS
       -A     This is equivalent to specifying -bBcdqrRuvwWy -I SUM -n FULL -P ALL.
       -b     Report I/O and transfer rate statistics. This option works only with kernels older than 2.5.  The following values are displayed:

              tps
                     Total number of transfers per second that were issued to the physical disk.  A transfer is an I/O request to the physical disk. Multiple logical requests
                     can be combined into a single I/O request to the disk.  A transfer is of indeterminate size.

              rtps
                     Total number of read requests per second issued to the physical disk.

              wtps
                     Total number of write requests per second issued to the physical disk.

              bread/s
                     Total  amount of data read from the drive in blocks per second.  Blocks are equivalent to sectors with 2.4 kernels and newer and therefore have a size of
                     512 bytes. With older kernels, a block is of indeterminate size.

              bwrtn/s
                     Total amount of data written to the drive in blocks per second.

       -B     Report paging statistics. The following values are displayed:

              pgpgin/s
                     Total number of kilobytes the system paged in from disk per second.

              pgpgout/s
                     Total number of kilobytes the system paged out to disk per second.

              fault/s
                     Number of page faults (major + minor) made by the system per second (post 2.5 kernels only).  This is not a count  of  page  faults  that  generate  I/O,
                     because some page faults can be resolved without I/O.

              majflt/s
                     Number of major faults the system has made per second, those which have required loading a memory page from disk (post 2.5 kernels only).

       -c     Report process creation activity.

              proc/s
                     Total number of processes created per second.

       -d     Report  activity  for each block device (kernels 2.4 and newer only).  When data is displayed, the device specification dev m-n is generally used ( DEV column).
              m is the major number of the device.  With recent kernels (post 2.5), n is the minor number of the device, but is only a sequence number with pre 2.5 kernels.

              tps
                     Indicate the number of transfers per second that were issued to the device.  Multiple logical requests can be combined into a single I/O request  to  the
                     device. A transfer is of indeterminate size.

              rd_sec/s
                     Number of sectors read from the device. The size of a sector is 512 bytes.

              wr_sec/s
                     Number of sectors written to the device. The size of a sector is 512 bytes.

       -e hh:mm:ss
              Set  the ending time of the report. The default ending time is 18:00:00. Hours must be given in 24-hour format.  This option can be used only when data are read
              from or written to a file (options -f or -o ). Note that if you also use -h option, ending time will have to be given in UTC (Coordinated Universal Time).

       -f filename
              Extract records from filename (created by the -o  filename  flag).  The  default  value  of  the  filename  parameter  is  the  current  daily  data  file,  the
              /var/log/sa/sadd file. The -f option is exclusive of the -o option.

       -h     When   reading  data  from  a  file,  print its contents in a format that can easily be handled by pattern processing commands like awk.  The output consists of
              fields separated by a tab. Each record contains the hostname of the host where sar was run, the interval value (or -1 if not  applicable),  the  timestamp  (UTC
              value - Coordinated Universal Time) in seconds from the epoch, the device name (or - if not applicable), the field name and its value.

       -H     When   reading data from a file, print its contents in a format that can easily be ingested by a relational database system. The output consists of fields sepa-
              rated by a semicolon. Each record contains the hostname of the host where sar was run, the interval value (or -1 if not applicable), the sar timestamp in a form
              easily  acceptable by most databases, and additional semicolon separated data fields as specified by other sar command line options.  Note that the timestamp is
              displayed in UTC (Coordinated Universal Time) unless option -t is used. In this latter case, the timestamp is displayed in local time.

       -i interval
              Select data records at seconds as close as possible to the number specified by the interval parameter.

       -I irq | SUM | ALL | XALL
              Report statistics for a given interrupt.  irq is the interrupt number. The SUM keyword indicates that the total number of interrupts received per second  is  to
              be displayed. The ALL keyword indicates that statistics from the first 16 interrupts are to be reported, whereas the XALL keyword indicates that statistics from
              all interrupts, including potential APIC interrupt sources, are to be reported.

       -n DEV | EDEV | SOCK | FULL
              Report network statistics.
              With the DEV keyword, statistics from the network devices are reported.  The following values are displayed:

              IFACE
                     Name of the network interface for which statistics are reported.

              rxpck/s
                     Total number of packets received per second.

              txpck/s
                     Total number of packets transmitted per second.

              rxbyt/s
                     Total number of bytes received per second.

              txbyt/s
                     Total number of bytes transmitted per second.

              rxcmp/s
                     Number of compressed packets received per second (for cslip etc.).

              txcmp/s
                     Number of compressed packets transmitted per second.

              rxmcst/s
                     Number of multicast packets received per second.

              With the EDEV keyword, statistics on failures (errors) from the network devices are reported.  The following values are displayed:

              IFACE
                     Name of the network interface for which statistics are reported.

              rxerr/s
                     Total number of bad packets received per second.

              txerr/s
                     Total number of errors that happened per second while transmitting packets.

              coll/s
                     Number of collisions that happened per second while transmitting packets.

              rxdrop/s
                     Number of received packets dropped per second because of a lack of space in linux buffers.

              txdrop/s
                     Number of transmitted packets dropped per second because of a lack of space in linux buffers.

              txcarr/s
                     Number of carrier-errors that happened per second while transmitting packets.

              rxfram/s
                     Number of frame alignment errors that happened per second on received packets.

              rxfifo/s
                     Number of FIFO overrun errors that happened per second on received packets.

              txfifo/s
                     Number of FIFO overrun errors that happened per second on transmitted packets.

              With the SOCK keyword, statistics on sockets in use are reported.  The following values are displayed:

              totsck
                     Total number of used sockets.

              tcpsck
                     Number of TCP sockets currently in use.

              udpsck
                     Number of UDP sockets currently in use.

              rawsck
                     Number of RAW sockets currently in use.

              ip-frag
                     Number of IP fragments currently in use.

              The FULL keyword is equivalent to specifying all the keywords above and therefore all the network activities are reported.

       -o filename
              Save the readings in the file in binary form. Each reading is in a separate record. The default value of the filename parameter is the current daily data  file,
              the /var/log/sa/sadd file. The -o option is exclusive of the -f option.

       -P cpu | ALL
              Report  per-processor  statistics  for  the specified processor or processors.  Specifying the ALL keyword reports statistics for each individual processor, and
              globally for all processors.  Of the flags which specify the statistics to be reported, only the -u and -I SUM flags are meaningful with the -P flag. Note  that
              processor 0 is the first processor.

       -p     Pretty-print  device  names.   By default names are printed as devn-m where n and m are the major and minor numbers for the device.  Use of this option displays
              the names of the devices as they (should) appear in /dev.  Name mappings are controlled by /etc/sysconfig/sysstat.ioconf.

       -q     Report queue length and load averages. The following values are displayed:

              runq-sz
                     Run queue length (number of processes waiting for run time).

              plist-sz
                     Number of processes in the process list.

              ldavg-1
                     System load average for the last minute.

              ldavg-5
                     System load average for the past 5 minutes.

              ldavg-15
                     System load average for the past 15 minutes.

       -r     Report memory and swap space utilization statistics.  The following values are displayed:

              kbmemfree
                     Amount of free memory available in kilobytes.

              kbmemused
                     Amount of used memory in kilobytes. This does not take into account memory used by the kernel itself.

              %memused
              kbbuffers
                     Amount of memory used as buffers by the kernel in kilobytes.

              kbcached
                     Amount of memory used to cache data by the kernel in kilobytes.

              kbswpfree
                     Amount of free swap space in kilobytes.

              kbswpused
                     Amount of used swap space in kilobytes.

              %swpused
                     Percentage of used swap space.

              kbswpcad
                     Amount of cached swap memory in kilobytes.  This is memory that once was swapped out, is swapped back in but still also is in the swap area (if memory is
                     needed it doesn’t need to be swapped out again because it is already in the swap area. This saves I/O).

       -R     Report memory statistics. The following values are displayed:

              frmpg/s
                     Number  of  memory  pages freed by the system per second.  A negative value represents a number of pages allocated by the system.  Note that a page has a
                     size of 4 kB or 8 kB according to the machine architecture.

              bufpg/s
                     Number of additional memory pages used as buffers by the system per second.  A negative value means fewer pages used as buffers by the system.

              campg/s
                     Number of additional memory pages cached by the system per second.  A negative value means fewer pages in the cache.

       -s hh:mm:ss
              Set the starting time of the data, causing the sar command to extract records time-tagged at, or following, the time specified. The  default  starting  time  is
              08:00.   Hours  must  be given in 24-hour format. This option can be used only when data are read from a file (option -f ). Note that if you also use -h option,
              starting time will have to be given in UTC (Coordinated Universal Time).

       -t     When reading data from a daily data file, indicate that sar should display the timestamps in the original locale time of the data  file  creator.  Without  this
              option,  the sar command displays the timestamps in the user locale time.  When this option is used together with option -H, the timestamp is displayed in local
              time instead of UTC (Coordinated Universal Time).  This option is ignored when option -h is used.

       -u     Report CPU utilization. The following values are displayed:

              %user
             Percentage of CPU utilization that occurred while executing at the user level (application).
              %nice
                     Percentage of CPU utilization that occurred while executing at the user level with nice priority.

              %system
                     Percentage of CPU utilization that occurred while executing at the system level (kernel).

              %iowait
                     Percentage of time that the CPU or CPUs were idle during which the system had an outstanding disk I/O request.

              %idle
                     Percentage of time that the CPU or CPUs were idle and the system did not have an outstanding disk I/O request.

       -v     Report status of inode, file and other kernel tables.  The following values are displayed:

              dentunusd
                     Number of unused cache entries in the directory cache.

              file-sz
                     Number of used file handles.

              inode-sz
                     Number of used inode handlers.

              super-sz
                     Number of super block handlers allocated by the kernel.

              %super-sz
                     Percentage of allocated super block handlers with regard to the maximum number of super block handlers that Linux can allocate.

              dquot-sz
                     Number of allocated disk quota entries.

              %dquot-sz
                     Percentage of allocated disk quota entries with regard to the maximum number of cached disk quota entries that can be allocated.

              rtsig-sz
                     Number of queued RT signals.

              %rtsig-sz
                     Percentage of queued RT signals with regard to the maximum number of RT signals that can be queued.

       -V     Print version number and usage then exit.
       -w     Report system switching activity.

              cswch/s
                     Total number of context switches per second.

       -W     Report swapping statistics. The following values are displayed:

              pswpin/s
                     Total number of swap pages the system brought in per second.

              pswpout/s
                     Total number of swap pages the system brought out per second.

       -x pid | SELF | ALL
              Report statistics for a given process.  pid is the process identification number. The SELF keyword indicates that statistics are to be reported for the sar pro-
              cess itself, whereas the ALL keyword indicates that statistics are to be reported for all the system processes.  All these statistics cannot be saved to a file.
              So this option will be ignored whenever -o option is used.  At the present time, no more than 256 processes can be monitored simultaneously.

              The following values are displayed:

              minflt/s
                     Total number of minor faults the process has made per second, those which have not required loading a memory page from disk.

              majflt/s
                     Total number of major faults the process has made per second, those which have required loading a memory page from disk.

              %user
                     Percentage of CPU used by the process while executing at the user level (application).

              %system
                     Percentage of CPU used by the process while executing at the system level (kernel).

              nswap/s
                     Number of pages from the process address space the system has swapped out per second.

              CPU
                     Processor number to which the process is attached.

       -X pid | SELF | ALL
              Report statistics for the child processes of the process whose PID is pid .  The SELF keyword indicates that statistics are to be reported for  the  child  pro-
              All these statistics cannot be saved to a file.  So this option will be ignored whenever -o option is used.  At the present time, no more than 256 processes can
              be monitored simultaneously.  The following values are displayed:

              cminflt/s
                     Total number of minor faults the child processes have made per second, those which have not required loading a memory page from disk.

              cmajflt/s
                     Total number of major faults the child processes have made per second, those which have required loading a memory page from disk.

              %cuser
                     Percentage of CPU used by the child processes while executing at the user level (application).

              %csystem
                     Percentage of CPU used by the child processes while executing at the system level (kernel).

              cnswap/s
                     Number of pages from the child process address spaces the system has swapped out per second.

       -y     Report TTY device activity. The following values are displayed:

              rcvin/s
                     Number of receive interrupts per second for current serial line. Serial line number is given in the TTY column.

              xmtin/s
                     Number of transmit interrupts per second for current serial line.

              Note that with recent 2.6 kernels, these statistics can be retrieved only by root.

ENVIRONMENT
       The sar command takes into account the following environment variable:

       S_TIME_FORMAT
              If  this variable exists and its value is ISO then the current locale will be ignored when printing the date in the report header.  The sar command will use the
              ISO 8601 format (YYYY-MM-DD) instead.

EXAMPLES
       sar -u 2 5
              Report CPU utilization for each 2 seconds. 5 lines are displayed.

       sar -I 14 -o int14.file 2 10
              Report statistics on IRQ 14 for each 2 seconds. 10 lines are displayed.  Data are stored in a file called int14.file.

       sar -r -n DEV -f /var/log/sa/sa16
              Display memory, swap space and network statistics saved in daily data file ’sa16’.
       sar -A
              Display all the statistics saved in current daily data file.

BUGS
       /proc filesystem must be mounted for the sar command to work.

       All the statistics are not necessarily available, depending on the kernel version used.

FILES
       /var/log/sa/sadd
              Indicate the daily data file, where the dd parameter is a number representing the day of the month.

       /proc contains various files with system statistics.

AUTHOR
       Sebastien Godard (sysstat <at> wanadoo.fr)

SEE ALSO
       sadc(8), sa1(8), sa2(8), isag(1), mpstat(1), iostat(1), vmstat(8)

       http://perso.wanadoo.fr/sebastien.godard/