How to Install and Use System Activity Reporter (SAR) in Linux

On Linux-based operating systems, System Activity Reporter (SAR) is an effective command-line utility for tracking system performance. Various system activity indicators, including CPU, RAM, disk I/O, network traffic, and more, are gathered, reported, and analyzed by SAR. This indispensable application helps admins monitor, debug, and optimize Linux servers and workstations proactively by giving rich insights into system behavior. Learn how SAR empowers users to maintain optimal system dependability and efficiency through exact capacity planning, resource allocation, and performance analysis. 

Installing SAR on Linux involves using package managers tailored to what distribution is used. Here's the guide for some well-known Linux distributions: 

Prerequisites

• System running in Linux Distribution (i.e. Ubuntu, Debian, Centos, Redhat and others).

You can deploy your Linux cloud server on Hostman. Effectively manage servers using SSH, ensuring maximum security without the need for traditional logins and passwords.

• Root access or user with sudo privileges.

Once all requirements are met, proceed with installation and configuration of SAR.

Installing SAR

1. Launch the terminal and make sure package list on the system is up to date by issuing the command below:

sudo apt update

2. Once the package list is already updated, proceed to install systat package. Run the command below: 

sudo apt install systat

Systat is a system monitoring tool available for Ubuntu and other Linux variants. It provides several tools and guidelines for monitoring system performance and resource usage. The systat package, which has commands like sar, mpstat, iostat, vmstat, and pidstat, can be used to collect and display system information.

3. Validate if package was installed successfully by running the command below:

sudo apt list systat

Collecting System Activity Data with SAR

SAR may not automatically start collecting data after installation. To enable data collection, make modifications to the sysstat configuration file. Before making any changes on the configuration file, make sure to back it up. Run command below:

sudo cp -rp /etc/default/sysstat /etc/default/sysstat.backup

After backup is completed, proceed to modifying the file by running:          

sudo nano /etc/default/sysstat

Find the line containing ENABLED="false": 

And change it to ENABLED="true":

Save and exit on the file by Ctrl X and press "Yes" when asked.

In order to initiate data collecting, the sysstat service must run. Use the command below: 

sudo systemctl start sysstat

Confirm if the ssystat service is running. Use the command below:

sudo systemctl status sysstat

Enable the sysstat service at boot time. This is to make sure the service is running every time server is rebooted or restarted. Use the command 

sudo enable sysstat

How to Utilize and Operate SAR

A multitude of data is produced by SAR, providing insights into many facets of system performance. A few examples of the output categories are network activity, CPU and memory utilization, disk input/output, and more. Every report includes comprehensive statistics to aid in the diagnosis of performance and system health problems. 

CPU utilization data

Syntax: 

sudo sar -u <interval in seconds> <count>

Note: interval and count can be changed depending on user's requirements.

Example: 

sudo sar -u 2 5

The flag meaning is below:

• -u - report the CPU utilization
• 2 - initiate data gathering every 2 seconds
• 5 - number of times the command will be run

This example displays the output every 2 seconds, 5 times.

Memory utilization data

Syntax: 

sudo sar -r <interval in seconds> <count>

Note: interval and count can be changed depending on user's requirements.

Example:

sudo sar -r 10 5 

The flag meaning is below:

• -r - report the Memory utilization
• 10 - initiate data gathering every 10 seconds
• 5 - number of times the command will be run

This example displays the output every 10 seconds, 5 times.

I/O and transfer rate statistics

Syntax: 

sudo sar -b <interval in seconds> <count>

Note: interval and count can be changed depending on user's requirements.

Example:

sudo sar -b 3 7

The flag meaning is below:

• -b - report the I/O and transfer rate statistics.
• 3 - initiate data gathering every 3 seconds.
• 7 - number of times the command will be run.

 This example displays the output every 3 seconds, 7 times.

Swap utilization data                                         

Syntax: 

sudo sar -S <interval in seconds> <count>

Note: interval and count can be changed depending on user's requirements.

Example:

sudo sar -S 5 5

The flag meaning is below:

• -S – report the swap utilization statistics.
• 5 - initiate data gathering every 5 seconds.
• 5 - number of times the command will be run.

This example displays the output every 5 seconds, 5 times.

Filesystem statistics                                              

Syntax: 

sudo sar -F <interval in seconds> <count>

Note: interval and count can be changed depending on user's requirements.

Example:

sudo sar -F 5 6

The flag meaning is below:

• -F - report the filesystem utilization statistics.
• 5 - initiate data gathering every 5 seconds.
• 6 - number of times the command will be run.

This example displays the output every 5 seconds, 6 times.

The SAR report can be saved by appending the output of the gathered data to a file. This can be used for future reference like historical investigation and analysis. Use the >> operator to append the data to a file. 

Example:

sudo sar -r 2 5 >> cpu_stat.txt

In this example, the output of the gathered memory utilization sar report will be appended to the file cpu_stat.txt. 

To view if the output is successfully appended to the file cpu_stat.txt, run the command: 

sudo cat cpu_stat.txt

Customizing SAR Reports 

You can customize the reports by choosing particular metrics, changing the way they are shown, and deciding how often they are collected. The following shows how to customize sar reports: 

• Determine which metrics should be included in the report based on your monitoring requirements. Some of the common metrics are: 

  • CPU utilization (-u)
  • memory usage (-r)
  • disk I/O (-b)
  • network activity (-n DEV)
  • load average (-q)

• Customize the display interval. The collection interval can be adjusted by using the -i option followed by the interval in seconds. Example:

sar -i 30

• Modify output format to improve readability or prepare it for additional processing. Use the -o option followed by the file name to send the output to a file rather than the terminal in order to reroute it. Example: 

sar -r 2 5 -o output.txt

• Integrate several reports into a single output to facilitate analysis by using the -f option followed by the path to the SAR file that you want to combine. Example:

sar -f output.txt >> output_2.txt; sar -f output_2.txt

• Produce reports for a specific time frame by using the parameters -s for start time (HH:MM:SS format) and -e for end time (HH:MM:SS). Example:

sar -s 02:00:00 -e 04:00:00

Conclusion

SAR is essentially a flexible toolkit for system analysis, monitoring, and optimization that helps with effective resource management and provides invaluable insights into system performance. Because of its extensive reporting capabilities and adaptable configuration options, it is a vital tool for preserving the security, stability, and well-being of computing environments.