Use sar to Monitor Resources in Linux
This article presents 10 ways that you can use the
System Activity Report (sar) command to monitor resources in Linux®.
1. Display the collective usage of all CPUs
Run the following command to display a summary of CPU usage:
sar -uThis command outputs the cumulative, real-time resource use of all CPUs.
You can add more parameters to this command. For example, adding 1 3 at
the end of the command as shown in the following example reports for every
1 second a total of 3 times:
The output is similar to the following example:
~]# sar -u 1 3
Linux 5.14.0-687.15.1.el9_8.x86_64 (node) 08/19/2026 _x86_64_ (8 CPU)
05:18:46 PM CPU %user %nice %system %iowait %steal %idle
05:18:47 PM all 0.51 0.00 0.00 0.00 0.00 99.49
05:18:48 PM all 1.00 0.00 1.12 0.12 0.00 97.76
05:18:49 PM all 0.75 0.00 0.50 0.00 0.00 98.74
Average: all 0.75 0.00 0.54 0.04 0.00 98.66The last field, %idle, indicates the CPU load.
The command has the following variations:
sar -u: Displays CPU usage for the current day.sar -u 1 3: Displays real-time CPU usage every 1 second for 3 times.sar -u ALL: Same as thesar -ucommand, but displays additional fields.sar -u ALL 1 3: Same as thesar -u 1 3command, but displays additional
fields.sar -u -f /var/log/sa/sa10: Displays CPU usage for the tenth day of the
month from thesa10file.
2. Display CPU usage by CPU or core
Run the following command to display CPU usage by CPU or core:
sar -P ALL 1 1The -P ALL flag indicates that you want to display statistics for
all of the individual cores.
In the CPU column of the following example output, 0, 1, 2, and 3
are CPU core numbers:
Linux 5.14.0-687.15.1.el9_8.x86_64 (node) 08/19/2026 _x86_64_ (8 CPU)
05:19:25 PM CPU %user %nice %system %iowait %steal %idle
05:19:26 PM all 0.63 0.00 0.51 0.00 0.00 98.86
05:19:26 PM 0 0.00 0.00 1.02 0.00 0.00 98.98
05:19:26 PM 1 1.00 0.00 2.00 0.00 0.00 97.00
05:19:26 PM 2 0.00 0.00 0.00 0.00 0.00 100.00
05:19:26 PM 3 1.01 0.00 0.00 0.00 0.00 98.99
05:19:26 PM 4 1.01 0.00 0.00 0.00 0.00 98.99
05:19:26 PM 5 0.00 0.00 0.00 0.00 0.00 100.00
05:19:26 PM 6 1.01 0.00 0.00 0.00 0.00 98.99
05:19:26 PM 7 1.00 0.00 1.00 0.00 0.00 98.00
Average: CPU %user %nice %system %iowait %steal %idle
Average: all 0.63 0.00 0.51 0.00 0.00 98.86
Average: 0 0.00 0.00 1.02 0.00 0.00 98.98
Average: 1 1.00 0.00 2.00 0.00 0.00 97.00
Average: 2 0.00 0.00 0.00 0.00 0.00 100.00
Average: 3 1.01 0.00 0.00 0.00 0.00 98.99
Average: 4 1.01 0.00 0.00 0.00 0.00 98.99
Average: 5 0.00 0.00 0.00 0.00 0.00 100.00
Average: 6 1.01 0.00 0.00 0.00 0.00 98.99
Average: 7 1.00 0.00 1.00 0.00 0.00 98.00
If you want to display statistics for only the second core,
use the -P 1 flag (because core numbers start from 0),
as shown in the following example:
sar -P 1 1 1The output looks like the following example:
Linux 5.14.0-687.15.1.el9_8.x86_64 (node) 08/19/2026 _x86_64_ (8 CPU)
05:19:45 PM CPU %user %nice %system %iowait %steal %idle
05:19:46 PM 1 2.00 0.00 1.00 0.00 0.00 97.00
Average: 1 2.00 0.00 1.00 0.00 0.00 97.00You might also find the following variations helpful:
sar -P ALL: Displays CPU usage for each core for the current day.sar -P ALL 1 3: Displays real-time CPU usage of each core
every 1 second for 3 times.sar -P 1: Displays CPU usage for core number 1 for the current day.sar -P 1 1 3: Displays real-time CPU usage for core number 1,
every 1 second for 3 times.sar -P ALL -f /var/log/sa/sa10: Displays CPU usage for each
core for the tenth day of the month from thesa10file.
3. Display free and used memory
Run the following command to display free and used memory:
sar -rIf you add 1 3 to the command as shown in the following example,
the output reports for every 1 second a total of 3 times:
sar -r 1 3The output looks like the following example, in whichkbmemfree is free memory and kbmemused is used memory:
Linux 5.14.0-687.15.1.el9_8.x86_64 (node) 08/19/2026 _x86_64_ (8 CPU)
05:20:11 PM kbmemfree kbavail kbmemused %memused kbbuffers kbcached kbcommit %commit kbactive kbinact kbdirty
05:20:12 PM 10067304 21376652 1973244 8.11 8796 11274148 7015844 28.83 2987424 9993588 32
05:20:13 PM 10068060 21377408 1972488 8.11 8796 11274148 7015844 28.83 2987044 9993588 32
05:20:14 PM 10068724 21378076 1971816 8.10 8796 11274156 7015844 28.83 2987060 9993592 40
Average: 10068029 21377379 1972516 8.11 8796 11274151 7015844 28.83 2987176 9993589 35
This command has the following variations:sar -rsar -r 1 3sar -r -f /var/log/sa/sa10
4. Display swap space use
Run the following command to display the amount of swap space that is in use:
sar -SIf you add 1 3 to the end of the command as shown in the following example,
the output reports for every 1 second a total of 3 times:
sar -S 1 3The output is similar to the following example:
Linux 5.14.0-687.15.1.el9_8.x86_64 (node) 08/19/2026 _x86_64_ (8 CPU)
05:20:34 PM kbswpfree kbswpused %swpused kbswpcad %swpcad
05:20:35 PM 0 0 0.00 0 0.00
05:20:36 PM 0 0 0.00 0 0.00
05:20:37 PM 0 0 0.00 0 0.00
Average: 0 0 0.00 0 0.00Note: If the kbswpused and %swpused are at 0, then your system
is not swapping.
This command has the following variations:
sar -Ssar -S 1 3sar -S -f /var/log/sa/sa10
Additional swap space commands
You might also find the following swap space commands helpful:
- Use
sar -Rto identify the number of memory pages that the system has
freed, used, and cached. - Use
sar -Hto identify the Linux® HugePages (in kilobytes (KB)) that
are in use and available. - Use
sar -Bto generate paging statistics such as the number of KB paged in
(and out) from disk per second. - Use
sar -Wto generate page swap statistics, such as page swap in (and out)
per second.
5. Display I/O activities
Run the following command to display overall input and output (I/O) activities:
sar -bThe output from this command displays I/O statistics. If you add 1 3 to the
end of the command as shown in the following example, the output reports for every 1 second a total of 3 times:
sar -b 1 3The output looks like the following example:
Linux 5.14.0-687.15.1.el9_8.x86_64 (node) 08/19/2026 _x86_64_ (8 CPU)
05:20:55 PM tps rtps wtps dtps bread/s bwrtn/s bdscd/s
05:20:56 PM 11.00 0.00 11.00 0.00 0.00 56.00 0.00
05:20:57 PM 4.00 0.00 4.00 0.00 0.00 64.00 0.00
05:20:58 PM 12.00 0.00 12.00 0.00 0.00 64.00 0.00
Average: 9.00 0.00 9.00 0.00 0.00 61.33 0.00The output includes the following fields:
tps: Transactions per second (both read and write)rtps: Read transactions per secondwtps: Write transactions per secondbread/s: Bytes read per secondbwrtn/s: Bytes written per second
This command has the following variations:
sar -bsar -b 1 3sar -b -f /var/log/sa/sa10
Note: Use sar -v to display the number of inode handlers, file handlers,
and pseudo-terminals that the system is using.
6. Display the I/O activities of individual block devices
Run the following command to display the I/O activities of individual block
devices:
sar -dTo identify activities by individual block device (such as a specific
mount point, logical unit number (LUN), or partition), use sar -d, as shown
in the following example:
sar -d 1 1The output looks like the following example:
Linux 5.14.0-687.15.1.el9_8.x86_64 (node) 08/19/2026 _x86_64_ (8 CPU)
05:21:12 PM DEV tps rkB/s wkB/s dkB/s areq-sz aqu-sz await %util
05:21:13 PM vda 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00
05:21:13 PM vdb 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00
05:21:13 PM vdc 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00
Average: DEV tps rkB/s wkB/s dkB/s areq-sz aqu-sz await %util
Average: vda 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00
Average: vdb 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00
Average: vdc 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00In this example, the values in the DEV column represent specific block
devices. For example, dev53-1 means a block device with 53 as major number,
and 1 as minor number.
You can use the pretty print (-p) flag as shown in the following example to
make the column display the actual device name (such as sda, sda1, or sdb1):
sar -p -d 1 1The output looks like the following example:
Linux 5.14.0-687.15.1.el9_8.x86_64 (node) 08/19/2026 _x86_64_ (8 CPU)
05:21:30 PM tps rkB/s wkB/s dkB/s areq-sz aqu-sz await %util DEV
05:21:31 PM 14.00 0.00 52.00 0.00 3.71 0.00 0.14 0.10 vda
05:21:31 PM 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 vdb
05:21:31 PM 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 vdc
Average: tps rkB/s wkB/s dkB/s areq-sz aqu-sz await %util DEV
Average: 14.00 0.00 52.00 0.00 3.71 0.00 0.14 0.10 vda
Average: 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 vdb
Average: 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 vdcThis command has the following variations:
sar -dsar -d 1 3sar -d -f /var/log/sa/sa10sar -p -d
7. Display the context switch per second
Run the following command to display the context switch per second:
sar -wThis command reports the total number of processes created per second and the
total number of context switches per second. If you add 1 3 to the end of
the command as shown in the following example, it reports for every 1 second
a total of 3 times:
sar -w 1 3The output is similar to the following example:
Linux 5.14.0-687.15.1.el9_8.x86_64 (node) 08/19/2026 _x86_64_ (8 CPU)
05:21:49 PM proc/s cswch/s
05:21:50 PM 29.00 10961.00
05:21:51 PM 0.00 8619.00
05:21:52 PM 55.00 14390.00
Average: 28.00 11323.33This command has the following variations:
sar -wsar -w 1 3sar -w -f /var/log/sa/sa10
8. Display the run queue and load average
Run the following command to display the run queue and load average:
sar -qThis command reports the run queue size and load average for the past minute,
past 5 minutes, and past 15 minutes. If you add 1 3 to the end of the
command as shown in the following example, it reports for every 1 second a
total of 3 times:
sar -q 1 3The output looks like the following example:
Linux 5.14.0-687.15.1.el9_8.x86_64 (node) 08/19/2026 _x86_64_ (8 CPU)
05:22:12 PM runq-sz plist-sz ldavg-1 ldavg-5 ldavg-15 blocked
05:22:13 PM 0 830 0.04 0.08 0.11 0
05:22:14 PM 0 830 0.04 0.08 0.11 0
05:22:15 PM 0 830 0.04 0.08 0.11 0
Average: 0 830 0.04 0.08 0.11 0Note: The blocked column displays the number of tasks that are currently
blocked and waiting for I/O operations to complete.
This command has the following variations:
sar -qsar -q 1 3sar -q -f /var/log/sa/sa10
9. Display network statistics
Run the following command to display network statistics:
sar -nThis command reports various network statistics, such as the number of packets
received (transmitted) through the network card or the number of packet
failures that occurred. If you add 1 3 to the end of the command, it reports
for every 1 second a total of 3 times.
You can also add a keyword to the command, as shown in the following example:
sar -n KEYWORDKEYWORD can be one of the following options:
DEV: Displays vital statistics for network devicesEDEV: Display failure statistics for network devicesNFS: Displays Network File System (NFS) client activitiesNFSD: Displays NFS server activitiesSOCK: Displays the sockets that are in use for IPv4IP: Displays IPv4 network trafficEIP: Displays IPv4 network errorsICMP: Displays ICMPv4 network trafficEICMP: Displays ICMPv4 network errorsTCP: Displays TCPv4 network trafficETCP: Displays TCPv4 network errorsUDP: Displays UDPv4 network trafficSOCK6,IP6,EIP6,ICMP6, andUDP6: Displays IPv6
network informationALL: Displays all of the preceding information
The following example uses the DEV keyword:
sar -n DEV 1 1The output looks like the following example:
~]# sar -n DEV 1 1
Linux 5.14.0-687.15.1.el9_8.x86_64 (node) 08/19/2026 _x86_64_ (8 CPU)
05:22:41 PM IFACE rxpck/s txpck/s rxkB/s txkB/s rxcmp/s txcmp/s rxmcst/s %ifutil
05:22:42 PM lo 262.00 262.00 109.85 109.85 0.00 0.00 0.00 0.00
05:22:42 PM eth0 6.00 8.00 0.72 9.81 0.00 0.00 0.00 0.00
05:22:42 PM docker0 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00
05:22:42 PM cali37d34eeba06 10.00 10.00 0.93 0.88 0.00 0.00 0.00 0.00
05:22:42 PM cali9b7955cbb2d 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00
05:22:42 PM cali4a361a315e5 5.00 6.00 0.46 0.50 0.00 0.00 0.00 0.00
05:22:42 PM tunl0 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00
Average: IFACE rxpck/s txpck/s rxkB/s txkB/s rxcmp/s txcmp/s rxmcst/s %ifutil
Average: lo 262.00 262.00 109.85 109.85 0.00 0.00 0.00 0.00
Average: eth0 6.00 8.00 0.72 9.81 0.00 0.00 0.00 0.00
Average: docker0 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00
Average: cali37d34eeba06 10.00 10.00 0.93 0.88 0.00 0.00 0.00 0.00
Average: cali9b7955cbb2d 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00
Average: cali4a361a315e5 5.00 6.00 0.46 0.50 0.00 0.00 0.00 0.00
Average: tunl0 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00
10. Report sar data by start time
Run the following command to report sar data by start time:
sar -sWhen you view historical sar data from the /var/log/sa/saXX file by using
the sar -f option, the output displays all of the sar data for that specific
day beginning at 12:00 a.m.
You can use the -s hh:mi:ss option to specify the start time. For example,
if you specify sar -s 10:00:00, the output from the command displays the sar
data beginning at 10 a.m. (instead of the default of midnight).
You can combine the -s flag with other sar flags. For example, to report the
load average on the 26th of the current month starting from 10 a.m., combine
the -q and -s flags as shown in the following example:
sar -q -f /var/log/sa/sa23 -s 10:00:01The output looks like the following example:
~]# sar -q -f /var/log/sa/sa23 -s 10:00:01 1 1
Linux 5.14.0-687.15.1.el9_8.x86_64 (node) 07/23/2026 _x86_64_ (8 CPU)
10:00:01 AM runq-sz plist-sz ldavg-1 ldavg-5 ldavg-15 blocked
10:10:01 AM 0 634 0.08 0.10 0.09 0
Average: runq-sz plist-sz ldavg-1 ldavg-5 ldavg-15 blocked
Average: 0 634 0.08 0.10 0.09 0You cannot specify an end time. Instead, you need to use the head
command. For example, if you want to start from 10 a.m. and see 7 entries, you
pipe the preceding output to head -n 10, as shown in the following example:
sar -q -f /var/log/sa/sa23 -s 10:00:01 | head -n 10The output looks like the following example:
Linux 5.14.0-687.15.1.el9_8.x86_64 (node) 07/23/2026 _x86_64_ (8 CPU)
10:00:01 AM runq-sz plist-sz ldavg-1 ldavg-5 ldavg-15 blocked
10:10:01 AM 0 634 0.08 0.10 0.09 0
10:20:01 AM 0 633 0.08 0.09 0.09 0
10:30:01 AM 0 635 0.49 0.23 0.14 0
10:40:01 AM 0 635 0.08 0.07 0.08 0
10:50:01 AM 2 639 0.65 0.34 0.18 0
11:00:01 AM 0 634 0.14 0.48 0.44 0
11:10:01 AM 0 635 0.13 0.15 0.27 0Updated 3 days ago