Sar command for viewing historical data

order

Sometimes, we have to check the performance value of the system, such as cpu load, to determine the reason for some kind of failure (frequent crash or sudden slowdown) of the system. Simple commands such as top, uptime and w can only view the current load, but not the cpu load in a certain period of time in the past.

The following is a command for performance analysis, which can be used to check the cpu load (system performance) in the past period of time.

To check the cpu usage over a period of time, skip to section 7.

I. The concept of search and rescue

Sysstat is a common toolkit in Linux system, and sar is one of the tools used to monitor the performance of Linux system.

Sysstat toolkit includes two kinds of tools: instant viewing tools (iostat, mpstat, SAR); Cumulative statistical tool

Therefore, sar command is also called system activity report. You can not only view the performance of the server in real time, but also make cumulative statistics.

Second, the scope of sar monitoring.

Reading and writing files

Use of system calls

Disk I/O usage

CPU usage statistics

Memory usage

Process activity

International Paralympic Committee related activities

Third, the sar command using environment

Sar command format:

Sar+ command line option (optional)+interval (optional)+times (optional)

Usually used to judge system bottlenecks.

The query CPU can use sar -u and sar -q to view the query memory, sar -B, sar -r and sar -W to view the query io, and sar -b, sar -u and sar -d to view it.

Fourth, the realization process of sar command cumulative statistics

The system will realize the function of recording the system performance information at that time on a regular basis by calling three tools (sa 1 sa2 sadc) in /usr/lib64/sa/.

Sa 1: Collect daily system performance information and write it into binary file, which is the front-end program of sadc.

Sa2: Collect daily system activity information and write it into a summary file as the front-end program of sar.

Sadc: Collect the dynamic data of the system and write it into a binary file as the back end of the sar tool.

Verb (abbreviation of verb) synthetic aperture radar logging

Sar has a function similar to log cutting, which will put logs into /var/log/sa/ according to the scheduled tasks in /etc/cron.d/sysstat.

Note: the log is a binary file and cannot be viewed with more, less and vim tools. You must use sar or sadf.

You can modify the scheduled task as needed.

If you want to check the performance of the server in a certain period of time, one of the methods is to use sar command to check the log files of the day.

sar -f /var/log/sa/sa 15

[root @ lib 64]# sar-f/var/log/sa/sa 15 Linux 3. 10.0-327 . el7 . x86 _ 64(ops-node 7)07/ 15/20 18 _ x86 _ 64 _(24 CPU) / kloc-0/2:00:0 1 amcpu % user % nice % system % iowait % steal % idle

note:

12/24 hour system used by sar to check performance or its logs; The log was hacked from 12 last night to 12 today. By default, only one month's logs are kept.

A detailed description of the parameters and output items of the intransitive verb sar command

1 format

Usage: sar+option+time interval (optional) +times (optional)

Interval: sampling period in seconds; Count: sampling times; The default value is 1 option: command line option.

2 common options

-A？ Sum of all reports -B? Output statistics of memory pages -b? Output I/O and transmission rate statistics? Output process statistics and the number of processes created per second? Output the activity information of each block device -H? Output swap space utilization information? Output help information -p? Output a friendly device name for easy viewing, usually combined with -d and -n parameters to use -q? Output process queue length and system average load state statistics? Output statistics of memory pages -r? Output statistics of memory and swap space? Output swap space utilization information? When reading the log data under /var/log/sa/, the original time recorded in it is displayed -u? Output statistics of overall CPU utilization -V? Output version information -v? Output kernel table state statistics (statistics of inode, files and other kernel tables) -W? Output statistics of system exchange -w? Output task creation and system conversion statistics -y? Output the activity information of the terminal equipment -I? Output statistics of specified interrupt before adding parameters {...|SUM|ALL|XALL}? ...？ Specify the total number of interrupts? Specifies the total number of interrupts received by the output per second? Specify the first 16 interrupt. XALL specifies to output all interrupt messages -P? Output the statistical information of the specified part of CPU, and then add the parameter {cpu|ALL}cpu? Specify cpuALL? Output statistics of individual and overall cpu-n? Output the statistics of network devices (network cards), and then add the parameter {dev | edev | NFS | nfsd | sock | all} dev? Output statistics of network devices EDEV output error statistics of network devices NFS? Output the activity statistics of NFS clients NFSD output the activity statistics of NFS servers SOCK output the usage statistics of network sockets ALL? Output all types of network activity statistics? Read data information from a file. Generally, you can read sar logs or files generated by the -o option, followed by the file name -o? Save the output information of sar to a file, and then add the file name -i? Specify the interval length in seconds? Specify the start time of outputting statistics (format: hh: mm: ss; Such as 0 1: 00: 00)? -e？ Specifies the deadline for outputting statistics, usually used with the -S option. When there is no numerical value, it defaults to 18:00:00 (format is hh: mm: ss; For example, 09: 00: 00)

3 output items

& lt 1 & gt； Output of cpu

sar -u

%usr？ The CPU is in user mode, and the percentage of execution time is %nice? The CPU is used for nice operation in user mode, accounting for% of the total CPU time. The system CPU is in system mode (kernel mode), and the percentage of time for executing processes is% iowait. The CPU is used for waiting for I/O operation to be completed (waiting for input and output to be completed), accounting for% of the total CPU time. Stealthhypervisor waits for the virtual CPU to provide services for another virtual process. %idle? Percentage of CPU idle time

note:

If the value of %iowait is too high, it means that there is an I/O bottleneck on the hard disk. If the value of %idle is high, it means that the CPU is idle. If the value of %idle is high but the system response is slow, the CPU may be waiting for memory allocation, and the memory capacity should be increased at this time. If the value of %idle is continuously lower than 10, the CPU processing capacity of the system is relatively low, indicating that CPU is the most needed resource in the system.

& lt2 & gtI/O and transmission rate output

sar -b

The number of times tps requests data from disk devices per second, including read and write requests, which is the sum of RTP and WTP. After each IO issue, multiple requests will be merged into one I/O disk request, where tps refers to the request count rtps after the request is merged? Number of read requests to disk devices per second? Number of write requests to disk devices per second Data read from physical devices per second (in blocks per second) Data written to physical devices per second (in blocks per second)

& lt3> Equipment Usage Output

synthetic aperture radar

DEV disk device, plus the parameter -p, can print out the names of disk devices such as sda; If the parameter -p is not added, the device will be displayed as the number of times per second that tps such as dev253-0 requests data from the disk device, including read and write requests, which is the sum of rtps and wtps. After each IO issue, multiple requests will be merged into one I/O disk request, where tps refers to the request count rd_sec/s? Number of sector reads per second? Number of writes to sectors per second avgrq-sz? Average data size of I/O operation per device (sector) avgqu-sz? What is the average waiting length of the disk request queue? The average consumption time of each request, including the waiting time of the request queue (in milliseconds), from requesting the disk to completing svctm processing. The average time for the system to process each request, excluding the time spent in the request queue. I/O requests as a percentage of CPU

& lt4> statistical information output of network equipment

EDEV special zone

IFACE？ Network device name rxpck/s number of packets received per second txpck/s number of packets sent per second rxbyt/s number of bytes received per second txbyt/s number of data received per second rxkB/s number of data sent per second (kB) rxcmp/s number of compressed packets received per second tx CMP/s. The total number of multicast packets received per second for network device troubleshooting.

& lt5> network equipment fault information output

Edev | egrep' eth0 | iface' (etho0 is specified this time, and other network cards can also be filled in).

I interface network device name rxerr/s number of bad packets received per second txerr/s number of errors in sending packets per second coll/s number of collisions in sending packets per second rxdrop/s number of packets discarded per second (due to lack of cache) txdrop/s number of packets discarded per second txcarr/s number of errors in sending packets per second rxfram/s number of frame check errors in receiving packets per second rxfifo/s number of buffer overflow errors in sending packets per second txfifo/s

& lt6> Memory Paging Status Output

sar -B

Bytes of pgpgin/s replaced from disk space or swap space to memory per second (KB) Bytes of pgpg out/s replaced from memory to disk space or swap space per second (KB) Number of missing pages generated by fault/s system per second (primary missing pages plus auxiliary missing pages) Number of primary missing pages generated by primary FLT/s per second pgfree/s Number of pages put into idle queue per second pgscank/ Pages scanned by s kswapd per second pgscand/s pages directly scanned per second pgsteal/s pages cleared from cache per second to meet memory requirements %vmeff pages cleared per second as a percentage of total scanned pages.

& lt7> Process Queue Length and Average Load Status Output

sar -q

runq-sz？ The length of the run queue and the number of processes waiting to run.

Number of processes and threads in plist-sz process list

ldavg- 1？ Average system load in the past 1 minute.

ldavg-5？ Average system load in the past 5 minutes

Ldavg- 15 Average system load in the past 15 minutes.

& lt8> Memory and Swap Space Status Output

synthetic aperture radar

Kbmemfree free memory (KB)kbmemused memory, excluding the memory used by the kernel (KB)%memused memory percentage kbbuffers kernel buffer, the amount of memory used (KB) KB Cache kernel cache data The amount of memory used (KB)kbcommit guarantees the memory needed by the current system, that is, the memory (RAM+swap)%commitkbcommit accounts for the percentage of all the total memory to ensure that it does not overflow.

& lt9> system exchange activity information output

sar -W

pswpin/s？ Number of pages swapped in by the system per second.

pswpout/s？ Number of pages swapped out by the system per second.

Seven, sar use examples-check the situation in a certain period of time.

& lt 1 & gt； Check the cpu from 1 to 3 am.

sar -s 0 1:00:00 -e 03:00:00

& lt2> Check the average load of the system from 1 to 3 am.

To view other performances in a certain period of time, add the corresponding options.

sar-s 0 1:00:00-e 03:00:00-q

& lt3> check the cpu on the 3rd of this month.

note: