Linux Administration Cookbook

sar

sar is a way of reading system information, but it also allows you to read historic information.

It's enabled with a systemctl command, which actually triggers a binary called sa1 to start at boot:

$ sudo systemctl enable --now sysstat

Run via a cron job, sar is executed every 10 minutes to grab system information. It then has a daily summary created at 23:53:

$ sudo cat /etc/cron.d/sysstat # Run system activity accounting tool every 10 minutes*/10 * * * * root /usr/lib64/sa/sa1 1 1# 0 * * * * root /usr/lib64/sa/sa1 600 6 &# Generate a daily summary of process accounting at 23:5353 23 * * * root /usr/lib64/sa/sa2 -A

To specify a sar file to open and read, use the -f flag:

 

$ sar -f /var/log/sa/sa13 Linux 3.10.0-862.2.3.el7.x86_64 (centos1) ...