Skip to content

sar – System Activity Reporter

The System Activity Reporter (sar) is part of the Linux syststat package. This package contains various system performance monitoring utilities (iostat, mpstat, pidstat, tapestat, cifsiostat and sar).

sar is useful because it not only shows system performance in real time, it also captures detailed system performance metrics and, if configured, stores them in data files, allowing for historic analysis, troubleshooting and reporting over days or weeks. Historic data collection needs to be configured in sar and I’ve documented how to do this in the “Enable data collection” section below.

sar metrics

  • CPU Metrics
    • -u → CPU utilization (user, system, idle, iowait, etc.)
    • -P → Per-processor CPU stats
    • -U → CPU usage by user/group (if accounting enabled)
    • -q → CPU run queue length and load average
  • Memory, Swap & Paging
    • -r → Memory usage (used, free, buffers, cache)
    • -S → Swap space usage
    • -B → Paging stats (page in/out, major faults)
  • Disk & I/O
    • -d → Block device I/O stats (read/write ops per sec, throughput)
    • -p → Device-level partition stats
    • -b → I/O and transfer rate (bread/s, bwrtn/s)
    • -y → TTY device activity
  • Network Interface
    • -n DEV → Network interfaces (rx/tx packets, errors, drops)
    • -n EDEV → Detailed interface errors
    • -n SOCK → Socket usage (TCP, UDP, RAW)
    • -n IP → IP-level stats
    • -n TCP → TCP connection stats (active, passive, retransmits, etc.)
    • -n UDP → UDP datagram activity
  • Filesystem & NFS
    • -v → I-node, file, and other kernel table usage
    • -m → Memory statistics (slabs, kmem, etc.)
    • -n NFS / -n NFSD → NFS client/server activity
  • Process Scheduling
    • -w → Task creation and context switch stats
  • Composite Options
    • -A → All metrics (a full system snapshot)
    • -f → Read from saved binary log file (/var/log/sysstat/saXX)
    • -s / -e → Specify start/end time
    • -i → Sampling interval

Installation process

Install with the Debian-based (Advanced Package Tool) apt. Stat with the “update” switch to refresh the local cache of available software packages. If there are updates available, list them with the “list” option. Upgrade the available updates and then installed the “sysstat” package.

sudo apt update

sudo apt list --upgradable

sudo apt upgrade

sudo apt install sysstat -y
Output… 
$ sudo apt update
http://deb.debian.org/debian bookworm InRelease
http://deb.debian.org/debian-security bookworm-security InRelease
http://deb.debian.org/debian bookworm-updates InRelease [55.4 kB]
http://archive.raspberrypi.com/debian bookworm InRelease [55.0 kB]
http://archive.raspberrypi.com/debian bookworm/main armhf Packages [554 kB]
http://archive.raspberrypi.com/debian bookworm/main arm64 Packages [551 kB]
Fetched 1,216 kB in 4s (299 kB/s)
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
4 packages can be upgraded. Run 'apt list --upgradable' to see them.


$ apt list --upgradable
Listing... Done
libssl-dev/stable 3.0.17-1~deb12u1+rpt1 arm64 [upgradable from: 3.0.17-1~deb12u1]
libssl3/stable 3.0.17-1~deb12u1+rpt1 arm64 [upgradable from: 3.0.17-1~deb12u1]
openssl/stable 3.0.17-1~deb12u1+rpt1 arm64 [upgradable from: 3.0.17-1~deb12u1]
raspi-config/stable,stable 20250805 all [upgradable from: 20250707]


$ sudo apt upgrade
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
Calculating upgrade... Done
The following packages will be upgraded:
  libssl-dev libssl3 openssl raspi-config
4 upgraded, 0 newly installed, 0 to remove and 0 not upgraded.
Need to get 7,368 kB of archives.
After this operation, 403 kB of additional disk space will be used.
Do you want to continue? [Y/n]
Get:1 http://archive.raspberrypi.com/debian bookworm/main arm64 libssl-dev arm64 3.0.17-1~deb12u1+rpt1 [3,455 kB]
Get:2 http://archive.raspberrypi.com/debian bookworm/main arm64 libssl3 arm64 3.0.17-1~deb12u1+rpt1 [2,376 kB]
Get:3 http://archive.raspberrypi.com/debian bookworm/main arm64 openssl arm64 3.0.17-1~deb12u1+rpt1 [1,499 kB]
Get:4 http://archive.raspberrypi.com/debian bookworm/main arm64 raspi-config all 20250805 [37.8 kB]
Fetched 7,368 kB in 5s (1,570 kB/s)
Reading changelogs... Done
(Reading database ... 192751 files and directories currently installed.)
Preparing to unpack .../libssl-dev_3.0.17-1~deb12u1+rpt1_arm64.deb ...
Unpacking libssl-dev:arm64 (3.0.17-1~deb12u1+rpt1) over (3.0.17-1~deb12u1) ...
Preparing to unpack .../libssl3_3.0.17-1~deb12u1+rpt1_arm64.deb ...
Unpacking libssl3:arm64 (3.0.17-1~deb12u1+rpt1) over (3.0.17-1~deb12u1) ...
Preparing to unpack .../openssl_3.0.17-1~deb12u1+rpt1_arm64.deb ...
Unpacking openssl (3.0.17-1~deb12u1+rpt1) over (3.0.17-1~deb12u1) ...
Preparing to unpack .../raspi-config_20250805_all.deb ...
Unpacking raspi-config (20250805) over (20250707) ...
Setting up libssl3:arm64 (3.0.17-1~deb12u1+rpt1) ...
Setting up libssl-dev:arm64 (3.0.17-1~deb12u1+rpt1) ...
Setting up openssl (3.0.17-1~deb12u1+rpt1) ...
Setting up raspi-config (20250805) ...
Processing triggers for man-db (2.11.2-2) ...
Processing triggers for libc-bin (2.36-9+rpt2+deb12u12) ...


$ sudo apt install sysstat -y
Reading package lists... Done
Building dependency tree... Done
Reading state information... Done
Suggested packages:
  isag
The following NEW packages will be installed:
  sysstat
0 upgraded, 1 newly installed, 0 to remove and 0 not upgraded.
Need to get 570 kB of archives.
After this operation, 1,988 kB of additional disk space will be used.
Get:1 http://deb.debian.org/debian bookworm/main arm64 sysstat arm64 12.6.1-1 [570 kB]
Fetched 570 kB in 0s (1,954 kB/s)
Preconfiguring packages ...
Selecting previously unselected package sysstat.
(Reading database ... 192751 files and directories currently installed.)
Preparing to unpack .../sysstat_12.6.1-1_arm64.deb ...
Unpacking sysstat (12.6.1-1) ...
Setting up sysstat (12.6.1-1) ...

Creating config file /etc/default/sysstat with new version
update-alternatives: using /usr/bin/sar.sysstat to provide /usr/bin/sar (sar) in auto mode
Created symlink /etc/systemd/system/sysstat.service.wants/sysstat-collect.timer → /lib/systemd/system/sysstat-collect.timer.
Created symlink /etc/systemd/system/sysstat.service.wants/sysstat-summary.timer → /lib/systemd/system/sysstat-summary.timer.
Created symlink /etc/systemd/system/multi-user.target.wants/sysstat.service → /lib/systemd/system/sysstat.service.
Processing triggers for man-db (2.11.2-2) ...
$

Confirm installation

$ which sar
$ sar -V
Output… 

$ which sar
/usr/bin/sar
$ sar -V
sysstat version 12.6.1
(C) Sebastien Godard (sysstat <at> orange.fr)
$

Enable data collection

Configure the “/etc/default/sysstat” file in order to enable the sysstat (including sar) historic data collection service. It must be activated and allowed to collect performance data.

$ sudo vim /etc/default/sysstat

Set the following line:

ENABLED="true"

Restart sysstat service

$ sudo systemctl enable sysstat

$ sudo systemctl start sysstat
Output… 
$ sudo systemctl enable sysstat
Synchronizing state of sysstat.service with SysV service script with /lib/systemd/systemd-sysv-install.
Executing: /lib/systemd/systemd-sysv-install enable sysstat
Created symlink /etc/systemd/system/multi-user.target.wants/sysstat.service → /lib/systemd/system/sysstat.service.
Created symlink /etc/systemd/system/sysstat.service.wants/sysstat-collect.timer → /lib/systemd/system/sysstat-collect.timer.
Created symlink /etc/systemd/system/sysstat.service.wants/sysstat-summary.timer → /lib/systemd/system/sysstat-summary.timer.
$
$ sudo systemctl start sysstat
$

Verify cron / timer setup

Checking to see that the shell script “debian-sa1” is calling the “sadc” binary that does actual system activity data collection.

$ cat /etc/cron.d/sysstat
Output… 
$ cat /etc/cron.d/sysstat
# The first element of the path is a directory where the debian-sa1
# script is located
PATH=/usr/lib/sysstat:/usr/sbin:/usr/sbin:/usr/bin:/sbin:/bin

# Activity reports every 10 minutes everyday
5-55/10 * * * * root command -v debian-sa1 > /dev/null && debian-sa1 1 1

# Additional run at 23:59 to rotate the statistics file
59 23 * * * root command -v debian-sa1 > /dev/null && debian-sa1 60 2
$

Extend data retention (optional)

Edit the “/etc/sysstat/sysstat”

$ sudo vim /etc/sysstat/sysstat

Add or modify the following line. History is set in days.

HISTORY=28

Restart sysstat service

$ sudo systemctl restart sysstat

Test Output #1 – Real time data example

The -u switch reports on CPU utilisation (but use any of the above listed switches to view different metrics. The numbers 1 5 mean 1 second intervals and 5 samples.

$ sar -u 1 5
Linux 6.12.34+rpt-rpi-2712 (server)      08/08/25        _aarch64_       (4 CPU)

13:44:02        CPU     %user     %nice   %system   %iowait    %steal     %idle
13:44:03        all      0.00      0.00      0.00      0.00      0.00    100.00
13:44:04        all      0.00      0.00      0.00      0.00      0.00    100.00
13:44:05        all      0.00      0.00      0.00      0.00      0.00    100.00
13:44:06        all      0.00      0.00      0.00      0.00      0.00    100.00
13:44:07        all      0.00      0.00      0.00      0.00      0.00    100.00
Average:        all      0.00      0.00      0.00      0.00      0.00    100.00
$

Test Output #2 – Today’s data

Todays is the 8th day of the month. So using sa08. Could also use sa$(date +%d)

$ sadf -d /var/log/sysstat/sa08 -- -u 
hostname;-1;2025-08-08 01:28:10 UTC;LINUX-RESTART  (4 CPU)  
# hostname;interval;timestamp;CPU;%user;%nice;%system;%iowait;%steal;%idle<br>hostname;570;2025-08-08 01:40:01 UTC;-1;0.02;0.00;0.01;0.01;0.00;99.96<br>hostname;537;2025-08-08 01:48:58 UTC;-1;0.03;0.00;0.01;0.01;0.00;99.95<br>hostname;93;2025-08-08 01:50:31 UTC;-1;0.04;0.00;0.02;0.01;0.00;99.92<br>hostname;580;2025-08-08 02:00:11 UTC;-1;0.02;0.00;0.02;0.01;0.00;99.96<br>hostname;-1;2025-08-08 02:06:28 UTC;LINUX-RESTART  (4 CPU)
# hostname;interval;timestamp;CPU;%user;%nice;%system;%iowait;%steal;%idle
$

Test Output #3 – Historic Data

Using yesterday’s day number sa07

$ sadf -d /var/log/sysstat/sa07 -- -u
hostname;-1;2025-08-07 01:28:10 UTC;LINUX-RESTART  (4 CPU)
# hostname;interval;timestamp;CPU;%user;%nice;%system;%iowait;%steal;%idle
hostname;570;2025-08-07 01:40:01 UTC;-1;0.02;0.00;0.01;0.01;0.00;99.96
hostname;537;2025-08-07 01:48:58 UTC;-1;0.03;0.00;0.01;0.01;0.00;99.95
hostname;93;2025-08-07 01:50:31 UTC;-1;0.04;0.00;0.02;0.01;0.00;99.92
hostname;580;2025-08-07 02:00:11 UTC;-1;0.02;0.00;0.02;0.01;0.00;99.96
hostname;-1;2025-08-07 02:06:28 UTC;LINUX-RESTART  (4 CPU)
# hostname;interval;timestamp;CPU;%user;%nice;%system;%iowait;%steal;%idle
$

That concludes this post. A simple process to get “sar” up and running. Hope you enjoy!!