Skip to main content



sar(系統活動回報程式)- Sar - RedHat/CentOS 內建的系統效能分析工具,這工具會蒐集、回報本日截至目前為止的系統活動資訊。預設的資訊包括本日的 CPU 使用率,每十分鐘採樣一次。


  • 內建在 CentOS/RedHat 5+版本,無需另外安裝。
  • 可查詢最近幾日的系統資源使用歷史紀錄,常作為事件後的問題偵錯工具。


  • CPU / IO / System / Nice / Idle percentages
  • Network Traffic / Network Errors
  • Load Average and Run queue
  • Interrupts
  • Memory Free / Cached / Buffered / Swapped
  • Device usage per Major/Minor number
  • And many others
Sar 如何運作
  • SAR writes to log files in /var/log/sa. This directory holds two types of files - sa\#\# files (binary) and sar\#\# files (text).
  • The number at the end of the file corresponds to the day of the month that file was recording.
  • For example, an sa03 file refers to the 03 day of the month.
  • When the sysstat package is installed it places a file into /etc/cron.d/sysstat.
  • This sets up two cron jobs.
    1. job to record statistics every 10 minutes.
    2. job to write the binary sa\#\# file to a text sar\#\# file once a day (typically right before midnight).
  • Additionally, it places a configuration file in /etc/sysconfig/sysstat.
  • 預設是保留最近七日的歷史資料,若要變更,可以修改 /etc/sysconfig/sysstat。
    Note that RHEL 4/5 sysstat does not support keeping more than 1 month of data; however, in RHEL6 if a HISTORY value greater than 28 is declared, SAR log files are automatically split up into separate directories.

Sar Cron Jobs:

# run system activity accounting tool every 10 minutes 
*/10 * * * * root /usr/lib/sa/sa1 1 1 

# generate a daily summary of process accounting at 23:53 
53 23 * * * root /usr/lib/sa/sa2 -A

If it is desired for SAR to collect data more frequently, simply change "*/10" to a new interval.

For example, if to make SAR to track every 5 minutes, simply change to "*/5".


SAR does not add significant load to a server. It safely can be tuned down to 2 minute intervals without seeing a significant problem. SAR also does not grab individual block data.

RHEL 8/9 不再使用 crontab 方式,如要調整 interval,請見下方步驟。


RedHat 5/6/7/8/9

yum install sysstat

For RHEL 8/9 only

systemctl start sysstat-collect.timer
設定 Interval (for RHEL 8/9)


systemctl cat sysstat-collect.timer
export SYSTEMD_EDITOR=/usr/bin/vi
systemctl edit sysstat-collect.timer

上述指令會開啟檔案: /etc/systemd/system/sysstat-collect.timer.d/override.conf ,將下方內容貼上

NOTE: 有一行 OnCalendar=<空白>,這行主要是用來移除預設值。

Description=Run system activity accounting tool every 1 minute



systemctl daemon-reload
systemctl restart sysstat-collect.timer


systemctl cat sysstat-collect.timer
systemctl status sysstat-collect.timer

顯示今日 CPU 狀態

# 每個處理器
sar -P ALL

# 顯示 CPU
sar -u 

顯示最近月份 13 號的網路狀態

sar -n ALL -f /var/log/sa/sa13

顯示最近一個月份 7 號 時間 10:00 - 14:00 的記憶體使用狀況,並將結果導出一個檔案

sar -r -s 10:00:00 -e 14:00:00 -f /var/log/sa/sa07 -o /tmp/mem.txt


# CPU on the Fly 10 times every 2 seconds
sar -u 2
sar -u 2 10
# Output to the file and read the file
sar -u 2 10 -o >/dev/null 2>&1 
sar -f

# Memory
# kbcommit & %commit is the overall memory used including RAM & Swap
sar -r 1
sar -r 1 10

# Swap
sar -S 1
sar -S 1 10

# I/O
sar -b 1
sar -b 1 10
sar -p -d 1
sar -p -d 1 10

# Paging
# - majflts/s shows the major faults per second means number of pages loaded into the memory from disk (swap), 
#   if its value is higher then we can say that system is running out of RAM.
# - %vmeff indicates the number of pages scanned per second, if it’s vaule is 100 % its is consider OK and 
#   when it is below 30 % then there is some issue with virtual memory. Zero value indicates that there is no page scanned during that time.
sar -B 1

# Network
sar -n ALL

RedHat 提供幾個透過線上的工具來分析
I/O 使用分析:

在系統內先執行 lsblk 將輸出內容導出一個檔案 lsblk.out,將此檔連同要分析的任一個 sarXX 檔上傳該網址,即可以圖形顯示系統 I/O 的使用狀態。

Memory 使用分析: