# sar

- <span class="application">**[How to use SAR to Monitor System Performance in Red Hat Enterprise Linux - Red Hat Customer Portal](https://access.redhat.com/solutions/276533)**</span>

##### <span class="application">**簡介**</span>

<span class="application">**sar**</span>（系統活動回報程式）- Sar - RedHat/CentOS 內建的系統效能分析工具，這工具會蒐集、回報本日截至目前為止的系統活動資訊。預設的資訊包括本日的 CPU 使用率，每十分鐘採樣一次。

特點：

- 內建在 CentOS/RedHat 5+版本，無需另外安裝。
- 可查詢最近幾日的系統資源使用歷史紀錄，常作為事件後的問題偵錯工具。

可分析的系統資訊包含如下：

- CPU / IO / System / Nice / Idle percentages
- Network Traffic / Network Errors
- Load Average and Run queue
- Interrupts
- Memory Free / Cached / Buffered / Swapped
- Device usage per Major/Minor number
- And many others

##### Sar 如何運作

- SAR writes to log files in /var/log/sa. This directory holds two types of files - sa\\#\\# files (binary) and sar\\#\\# files (text).
- The number at the end of the file corresponds to the day of the month that file was recording.
- For example, an sa03 file refers to the 03 day of the month.
- When the sysstat package is installed it places a file into /etc/cron.d/sysstat.
- This sets up two cron jobs. 
    1. job to record statistics every 10 minutes.
    2. job to write the binary sa\\#\\# file to a text sar\\#\\# file once a day (typically right before midnight).
- Additionally, it places a configuration file in /etc/sysconfig/sysstat.
- 預設是保留最近七日的歷史資料，若要變更，可以修改 /etc/sysconfig/sysstat。  
    Note that RHEL 4/5 sysstat does not support keeping more than 1 month of data; however, in RHEL6 if a HISTORY value greater than 28 is declared, SAR log files are automatically split up into separate directories.

Sar Cron Jobs：  
/etc/cron.d/sysstat

```
# run system activity accounting tool every 10 minutes 
*/10 * * * * root /usr/lib/sa/sa1 1 1 

# generate a daily summary of process accounting at 23:53 
53 23 * * * root /usr/lib/sa/sa2 -A
```

If it is desired for SAR to collect data more frequently, simply change "\*/10" to a new interval.

For example, if to make SAR to track every 5 minutes, simply change to "\*/5".

> NOTE:
> 
> SAR does not add significant load to a server. It safely can be tuned down to 2 minute intervals without seeing a significant problem. SAR also does not grab individual block data.
> 
> RHEL 8/9 不再使用 crontab 方式，如要調整 interval，請見下方步驟。

##### 安裝

RedHat 5/6/7/8/9

```
yum install sysstat
```

For RHEL 8/9 only

```
systemctl start sysstat-collect.timer
```

##### 設定 Interval (for RHEL 8/9)

執行

```
systemctl cat sysstat-collect.timer
export SYSTEMD_EDITOR=/usr/bin/vi
systemctl edit sysstat-collect.timer
```

上述指令會開啟檔案: `/etc/systemd/system/sysstat-collect.timer.d/override.conf` ，將下方內容貼上

> NOTE: 有一行 OnCalendar=&lt;空白&gt;，這行主要是用來移除預設值。

```
[Unit]
Description=Run system activity accounting tool every 1 minute

[Timer]
OnCalendar=
OnCalendar=*:00/1
```

套用變更

```
systemctl daemon-reload
systemctl restart sysstat-collect.timer
```

驗證

```
systemctl cat sysstat-collect.timer
systemctl status sysstat-collect.timer
```

##### 使用方法

顯示今日 CPU 狀態

```shell
# 每個處理器
sar -P ALL

# 顯示 CPU
sar -u 
```

顯示最近月份 13 號的網路狀態

```
sar -n ALL -f /var/log/sa/sa13
```

顯示最近一個月份 7 號 時間 10:00 - 14:00 的記憶體使用狀況，並將結果導出一個檔案

```
sar -r -s 10:00:00 -e 14:00:00 -f /var/log/sa/sa07 -o /tmp/mem.txt
```

即時監看

```shell
# CPU on the Fly 10 times every 2 seconds
sar -u 2
sar -u 2 10
# Output to the file and read the file
sar -u 2 10 -o cpu.sa >/dev/null 2>&1 
sar -f cpu.sa

# Memory
# kbcommit & %commit is the overall memory used including RAM & Swap
sar -r 1
sar -r 1 10

# Swap
sar -S 1
sar -S 1 10

# I/O
sar -b 1
sar -b 1 10
sar -p -d 1
sar -p -d 1 10

# Paging
# - majflts/s shows the major faults per second means number of pages loaded into the memory from disk (swap), 
#   if its value is higher then we can say that system is running out of RAM.
# - %vmeff indicates the number of pages scanned per second, if it’s vaule is 100 % its is consider OK and 
#   when it is below 30 % then there is some issue with virtual memory. Zero value indicates that there is no page scanned during that time.
sar -B 1

# Network
sar -n ALL
```

> Tips:
> 
> - Memory Swaping 嚴重：papgin/papgout/majflt 連續不斷出現高數值

##### 線上分析器

RedHat 提供幾個透過線上的工具來分析  
I/O 使用分析: [https://access.redhat.com/labs/rhiou/](https://access.redhat.com/labs/rhiou/)

> 在系統內先執行 lsblk 將輸出內容導出一個檔案 lsblk.out，將此檔連同要分析的任一個 sarXX 檔上傳該網址，即可以圖形顯示系統 I/O 的使用狀態。

Memory 使用分析: [https://access.redhat.com/labs/rhma/](https://access.redhat.com/labs/rhma/)

##### 延伸閱讀

- [Monitoring Linux system resources using SAR (System Activity Report)](https://linuxtechlab.com/monitoring-system-resources-using-sar/)
- [Sar command usage with examples in Linux](https://www.crybit.com/sar-command/)
- [The Sysadmin's Toolbox: sar](https://www.linuxjournal.com/content/sysadmins-toolbox-sar)