The word "
sar" is used to refer to two related items:
- The system activity report package
- The system activity reporter
System Activity Report Package
This facility stores a great deal of performance data about a system.
This information is invaluable when attempting to identify the source
of a performance problem.
The Report Package can be enabled by uncommenting the appropriate lines
in the sys crontab. The
sa1 program stores
performance data in the
writes reports from this data, and
sadc is a more
general version of
In practice, I do not find that the
are terribly useful in most cases. Depending on the issue being
examined, it may be sufficient to run
sa1 at intervals
that can be set in the sys crontab.
sar can be used on the command line to
look at performance over different time slices or over a constricted
period of time:
sar -A -o outfile 5 2000
(Here, "5" represents the time slice and "2000" represents the
number of samples to be taken. "outfile" is the output file where
the data will be stored.)
The data from this file can be read by using the "-f" option (see
System Activity Reporter
sar has several options that allow it to process the data
sa1 in different ways:
- -a: Reports file system access statistics. Can be used
to look at issues related to the DNLC.
- iget/s: Rate of requests for inodes not in the DNLC.
iget will be issued for each path component of
the file's path.
- namei/s: Rate of file system path searches. (If the
directory name is not in the DNLC,
iget calls are made.)
- dirbk/s: Rate of directory block reads.
- -A: Reports all data.
- -b: Buffer activity reporter:
- bread/s, bwrit/s: Transfer rates (per second) between system
buffers and block devices (such as disks).
- lread/s, lwrit/s: System buffer access rates (per second).
- %rcache, %wcache: Cache hit rates (%).
- pread/s, pwrit/s: Transfer rates between system buffers and
- -c: System call reporter:
- scall/s: System call rate (per second).
- sread/s, swrit/s, fork/s, exec/s: Call rate for these calls
- rchar/s, wchar/s: Transfer rate (characters per second).
- -d: Disk activity (actually, block device activity):
- %busy: % of time servicing a transfer request.
- avque: Average number of outstanding requests.
- r+w/s: Rate of reads+writes (transfers per second).
- blks/s: Rate of 512-byte blocks transferred (per second).
- avwait: Average wait time (ms).
- avserv: Average service time (ms). (For block devices,
this includes seek rotation and data transfer times. Note that the
equivalent to the
- -e HH:MM: CPU useage up to time specified.
- -f filename: Use filename as the source for
sar data. The default is to use today's file
- -g: Paging activity (see "Paging"
for more details):
- pgout/s: Page-outs (requests per second).
- ppgout/s: Page-outs (pages per second).
- pgfree/s: Pages freed by the page scanner (pages per second).
- pgscan/s: Scan rate (pages per second).
- %ufs_ipf: Percentage of UFS inodes removed from the free list
while still pointing at reuseable memory pages. This is the same as
the percentage of igets that force page flushes.
- -i sec: Set the data collection interval to i seconds.
- -k: Kernel memory allocation:
- sml_mem: Amount of virtual memory available for the small pool
(bytes). (Small requests are less than 256 bytes)
- lg_mem: Amount of virtual memory available for the large pool
(bytes). (512 bytes-4 Kb)
- ovsz_alloc: Memory allocated to oversize requests (bytes).
Oversize requests are dynamically allocated, so there is no pool.
(Oversize requests are larger than 4 Kb)
- alloc: Amount of memory allocated to a pool (bytes). The total
KMA useage is the sum of these columns.
- fail: Number of requests that failed.
- -m: Message and semaphore activities.
- msg/s, sema/s: Message and semaphore statistics (operations
- -o filename: Saves output to filename.
- -p: Paging activities.
- atch/s: Attaches (per second). (This is the number of page
faults that are filled by reclaiming a page already in memory.)
- pgin/s: Page-in requests (per second) to file systems.
- ppgin/s: Page-ins (per second). (Multiple pages may
be affected by a single request.)
- pflt/s: Page faults from protection errors (per second).
- vflts/s: Address translation page faults (per second).
(This happens when a valid page is not in memory. It is comparable
- slock/s: Faults caused by software lock requests that
require physical I/O (per second).
- -q: Run queue length and percentage of the time that
the run queue is occupied.
- -r: Unused memory pages and disk blocks.
- freemem: Pages available for use (Use
to determine the size of the pages).
- freeswap: Disk blocks available in swap (512-byte blocks).
- -s time: Start looking at data from time
- -u: CPU utilization.
- %usr: User time.
- %sys: System time.
- %wio: Waiting for I/O (does not include time when
another process could be schedule to the CPU).
- %idle: Idle time.
- -v: Status of process, inode, file tables.
- proc-sz: Number of process entries (proc structures)
currently in use, compared with
- inod-sz: Number of inodes in memory compared with
the number currently allocated in the kernel.
- file-sz: Number of entries in and size of the open
file table in the kernel.
- lock-sz: Shared memory record table entries currently
used/allocated in the kernel. This size is reported as 0 for
standards compliance (space is allocated dynamically for this
- ov: Overflows between sampling points.
- -w: System swapping and switching activity.
- swpin/s, swpot/s, bswin/s, bswot/s: Number of
LWP transfers or 512-byte blocks per second.
- pswch/s: Process switches (per second).
- -y: TTY device activity.
- rawch/s, canch/s, outch/s: Input character rate, character
rate processed by canonical queue, output character rate.
- rcvin/s, xmtin/s, mdmin/s: Receive, transmit and modem
Page © 2011 by the Trustees of Princeton University.
Content © 2011 by Scott Cromar, from The Solaris Troubleshooting Handbook. Used with permission.
Comments on the contents of this page may be logged to
The Solaris Troubleshooting Blog