sar(1M)

sar -- system activity reporter

Synopsis

sar [-P processor_id[, . . . ] | ALL] [-ubdDycwaqvtmpgrkAR] [-o file] t [n]
sar [-P processor_id[, . . . ] | ALL] [-ubdDycwaqvtmpgrkAR] [-s time] [-e time] [-i sec] [-f file]

Description

The command sar provides usage information for individual processors, as well as summary information for average processor usage.

In the first synopsis line, sar samples cumulative activity counters in the operating system at n intervals of t seconds, where t should be 5 or greater and the default value of n is 1. (Note that if the sampling interval is less than 5, the activity of sar itself may affect the sample.) If the -o option is specified, sar saves the samples in file in binary format. The type of command shown in the first synopsis line immediately sends the output for every option specified to standard output, without organizing it into a rational format; data for different options appears in an undifferentiated jumble and is difficult to read. Therefore, when running sar in the format of the first synopsis line, we recommend:

specifying only one option, and
avoiding the -A option (which is equivalent to specifying all options)

In the second synopsis line, with no sampling interval specified, sar extracts data from a previously recorded file, either the one specified by the -f option or, by default, the standard system activity daily data file /var/adm/sa/sadd for the current day dd. The starting and ending times of the report can be bounded using the -s and -e time arguments of the form

hh[:mm[:ss]]

The -i option selects records at sec second intervals. Otherwise, all intervals found in the data file are reported.

When displaying data, sar fits numbers within their allocated field widths by changing output formats.

if the number exceeds the output field width and it has decimal places, sar drops the decimal places.
if removing decimal places does not make the number fit, sar prints the number in ``shortened exponential notation''. For example, if the number is ``123456578'' and the field width is 6, sar prints ``1.23e7''.

Options

Subsets of data to be printed are specified by option:

-P

Report system activity for the specified processors rather than for system wide activity. System wide data will be reported for those metrics that do not have per-processor counts. The processor list is a list of processor IDs separated by commas, or ALL to request reports for all processors. In the former case, only data for the specified processors is reported. Specifying ALL causes data for every processor to be reported as well as system wide data. Note that system wide data is suppressed (for metrics collected per-processor) unless the ALL option is used (even if the processor list includes all processors).

When the -P option is not specified, aggregate information is displayed.

-u

Report processor utilization (the default):

%usr: portion of time running in user mode
%sys: portion of time running in system mode
%wio: portion of time idle with some process waiting for block I/O
%idle: portion of time otherwise idle
%intr: portion of time spent in interrupt handling

-b

Report buffer activity:

bread/s, bwrit/s: transfers per second of data between system buffers and disk or other block devices
lread/s, lwrit/s: accesses per second of system buffers
%rcache, %wcache: cache hit ratios, such as ((lread-bread)/lread) as a percentage
pread/s, pwrite/s: transfers per second by means of raw (physical) device mechanism

If the -R option has been specified, the %rcache and %wcache columns are not displayed. In addition, bwrit/s is displayed as bwrite and lwrit/s as lwrite.

-d

Report activity for hard disks. In the data display, the device column specifies the individual slices on the disk, as well as the entire disk itself. The slices are referred to as cCbBtTdDsS, and the full disk is referred to as cCbBtTdD. The disk(7) reference page contains an explanation of this disk and slice naming notation.

The data reported is:

MB: the size in megabytes of the disk or slice
%busy: percentage of time disk was busy servicing a transfer request
avque: average number of requests outstanding during the monitored period (the number of requests being serviced); this number is the ratio of total time for all requests to complete to total time disk was busy servicing the requests minus 1
r+w/s: number of data transfers to or from disk per second
blks/s: number of 512-byte blocks transferred to or from the disk per second
avwait: average time in milliseconds that transfer requests wait idly on queue
avserv: average time in milliseconds for a transfer request to be completed by the disk (including seek, rotational latency, and data transfer times)

When the -R option has been specified, the columns avque, avwait, and avserv are not displayed. Two additional columns, busy and resp are also displayed. busy shows the total time in microseconds that the disk was active. resp shows the elapsed time in microseconds times the queue length over the interval.

-D

Report activity for hard disks; major difference from -d is that read and write statistics are listed individually with -D. In the data display, the device column specifies the individual slices on the disk, as well as the entire disk itself. The slices are referred to as cCbBtTdDsS, and the full disk is referred to as cCbBtTdD. See disk(7) for an explanation of the disk and slice naming notation. The data reported by -D is:

MB: the size in megabytes of the disk or slice
%busy: percentage of time disk was busy servicing a transfer request
avque: average number of requests outstanding during the monitored period (the number of requests being serviced); this number is the ratio of total time for all requests to complete to total time disk was busy servicing the requests minus 1; if the -R option is also specified, avque is not displayed
r/s: number of data transfers from disk per second
r_blks/s: number of 512-byte blocks transferred from the disk per second
w/s: number of data transfers to disk per second
w_blks/s: number of 512-byte blocks transferred to the disk per second

-y

Report TTY device activity (per second):

rawch/s: input characters
canch/s: input characters processed by canon
outch/s: output characters
rcvin/s: receiver hardware interrupts
xmtin/s: transmitter hardware interrupts
mdmin/s: modem interrupts

-c

Report system calls (per second):

scall/s: system calls of all types
sread/s, swrit/s, fork/s, exec/s: specific system calls (read, write, fork, and exec)
rchar/s: characters (bytes) transferred by read system calls
wchar/s: characters (bytes) transferred by write system calls
lwpcr/s: number of LWPs created

-w

Report system swapping and switching activity (per second):

swpin/s, swpot/s: number of transfers to and from memory
pswin/s, pswot/s: number of pages transferred for swapins and swapouts
vpswout/s: number of virtual pages transferred because of swapouts
pswch/s: process switches

-a

Report use of file access system routines (per second):

iget/s: number of S5, SFS, VXFS, BFS, and UFS files located by inode entry
namei/s: number of filesystem path searches
dirbk/s: number of S5 directory block reads issued
%dnlc: hit rate of directory name lookup cache

If -R is specified then %dnlc is replaced by dnlc-hits and dnlc-miss, the counts of cache hits and misses.

-q

Report average queue length while occupied, and percentage of time occupied:

prunq: size of processor private queue of process in memory and runnable
%prunocc: percentage of time processor private run queue is occupied
runq: size of run queue of processes in memory and runnable
%runocc: percentage of time run queue is occupied
swpq: the average number of processes in the swap queue when there were processes in the queue If there were no processes in the swap queue, this field is blank.
%swpocc: the percent of time during the sample that there were processes in the swap queue. If there were no processes in the swap queue, this field is blank.

If the -P option has not been specified, then the prunq and %prunocc columns will be blank.

-v

Report status of process, lightweight processes, i-node, file, and file and record locking tables for each filesystem:

proc-sz, lwp, inod-sz, file, lock: entries/size for each table, evaluated once at sampling point.
fail: overflows that occur between sampling points for each table.

-t

Report usage by filesystem type:

file system

filesystem type (either s5, combined sfs and ufs, vxfs, or other)

inodes

inuse: current number of inode table entries being used by processes.
alloc: current number of inode table entries existing (both in use and free).
limit: maximum limit of inodes that can be allocated. (This is a soft upper limit, so alloc may exceed limit.)
fail: number of inode allocation failures that occur between sampling points. (This can occur when the limit is exceeded or when memory for inodes is unavailable.)

%ipf

the percentage of inodes taken off the freelist by iget that had reusable pages associated with them. These pages are flushed and cannot be reclaimed by processes. Thus, this is the percentage of igets that cause page flushes.

If the -R option has been specified, the %ipf column is not displayed. Instead, the columns ipage and inopage, equal to the counts of inodes with and without reusable pages respectively, are displayed.

-m

Report message and semaphore activities:

msg, sema: primitives per second

-p

Report paging activities:

atch/s: page faults per second that are satisfied by reclaiming a page currently in memory (attaches per second)
atfree/s: page faults per second that are satisfied by a page on the free list
atmiss/s: page faults per second not fulfilled by a page in memory
pgin/s: page-in requests per second
ppgin/s: pages paged-in per second
pflt/s: page faults from protection errors per second (invalid access to page or ``copy-on-writes'')
vflt/s: address translation page faults per second (valid page not in memory)
slock/s: faults per second caused by software lock requests requiring physical I/O

-g

Report paging activities:

pgout/s: page-out requests per second
ppgout/s: pages paged-out per second
vfree/s: virtual pages per second placed on the freelist by the page stealing daemon
pfree/s: physical pages per second placed on the freelist by the page stealing daemon
vscan/s: virtual pages per second scanned by the page stealing daemon

When the -R option has been specified, raw counts for pgout/s are shown as pgouts, ppgout/s as ppgouts, vfree/s as vfrees, pfree/s as pfrees, and vscan/s as vscans.

-r

Report unused memory pages (in units of 4096 bytes on IA32 systems):

freemem: free physical memory available to user processes
freeswap: free virtual memory (physical + swap) available to user processes
freekv: free address space available for kernel mappings
filemem: that part of freemem which can be used to cache file data

-k

Report kernel memory allocation (KMA) activities:
The following information is displayed for each memory pool: (Memory pools that are used by the system as special object pools are grouped together as ``Objs'')

size: the size of buffers in the memory pool, or Ovsz for the oversize pool
mem: the amount of memory in bytes KMA has for the pool
alloc: the number of bytes allocated from this pool
succ: the amount of memory requested by KMA customers and successfully allocated. This may be less than the alloc column since the buffers are predetermined sizes.
fail: the number of requests that were not satisfied (failed)

-A

Report all data (equivalent to -udqbwcayvtmpgrk). When -P is specified, per processor output is produced for the appropriate options, and system wide information is produced for the other options.

-R

Report raw data values. Using this option, sar displays the values of the counters from which metrics are computed, rather than computed values. For example, when used with -u, the number of clock ticks are displayed rather than a percentage.

When using the -R option, % prefixes and /s suffixes are not displayed in column headings. For example, instead of %name or name/s, the heading becomes name. Some tables are displayed differently; the layout of tables reporting the ratio of two counters is changed. Columns that are computed from more than one counter are not displayed. If one, or both, of these counters is not already output in another column, then a new column is added for it. This changes the tables for the options -b, -d, -a, -t. At the end of the report averages are not computed; instead, the totals from which the averages are derived are displayed.

Examples

To see today's processor activity so far:

sar

To see the system call activity so far for processor 0:

sar -c -P0

To see today's processor activity, broken down by processor for all processors:

sar -P ALL

To see today's processor activity for processors 2 and 3 only:

sar -P 2,3

To watch processor activity evolve for ten minutes and save data:

sar -o temp 60 10

To later review disk activity from that period:

sar -d -f temp

Files

/var/adm/sa/sadd: daily data file, where dd are digits representing the day of the month

References

sadc(1M)

Notices

The start (-s) and end (-e) times cannot overlap at midnight.