sar – System Running Status Statistics Tool

SAR (System Activity Reporter) is a Linux command-line utility that provides performance monitoring and system activity reporting. SAR collects, reports, and saves system activity information such as CPU utilization, memory usage, disk activity, network traffic, and more. This tool is useful for system administrators to analyze system performance over time, identify performance bottlenecks, and troubleshoot system issues.


The SAR command is typically used with a time interval specified in seconds, minutes, or hours. It collects system activity data at the specified interval and displays the data on the terminal. SAR can also save the collected data to a file for later analysis.

Here is the basic syntax of the SAR command:

sar [options] [interval] [count]
  • [options]: The available options for the SAR command are described in the next section.
  • [interval]: The time interval between each data collection. The default interval is 10 minutes.
  • [count]: The number of times to collect data. The default count is 1.


  1. To display CPU utilization every 5 seconds, run the following command:
sar -u 5
  1. To display memory usage every 10 minutes and save the data to a file, run the following command:
sar -r -o /var/log/sar/memory.log 600
  1. To display disk activity every 2 hours and save the data to a file, run the following command:
sar -b -o /var/log/sar/disk.log 7200


Here are the available options for the SAR command:

Option Description
-u Display CPU utilization statistics.
-r Display memory utilization statistics.
-b Display I/O and transfer rate statistics for block devices.
-n Display network statistics.
-q Display queue length and load average statistics.
-o Save the collected data to a file instead of displaying it on the terminal.
-f Read data from a file instead of the system activity file.
-h Display help information.

Troubleshooting tips

  • If the SAR command is not installed on your system, you can install it using your package manager. For example, on Ubuntu and Debian-based systems, run sudo apt-get install sysstat.
  • If you encounter errors when running the SAR command, make sure that the system activity file is accessible. The default location of the file is /var/log/sa/sa[DD], where [DD] is the day of the month (01-31).
  • If you want to collect data for a specific time range, you can use the sar -s and sar -e options to specify the start and end times. For example, sar -u -s 09:00:00 -e 09:30:00 will collect CPU utilization data from 9:00 AM to 9:30 AM.


  • The SAR command is part of the sysstat package, which also includes other system monitoring utilities such as iostat and mpstat.
  • The system activity file is rotated daily and saved as /var/log/sa/sa[DD]. You can change the location and rotation settings in the /etc/sysconfig/sysstat file.
  • The SAR command can be used with other utilities such as awk and gnuplot to generate graphs and reports from the collected data.