sar

sar

The word "sar" is used to refer to two related items:

1. The system activity report package
2. The system activity reporter

System Activity Report Package

This facility stores a great deal of performance data about a system. This information is invaluable when attempting to identify the source of a performance problem.

The Report Package can be enabled by uncommenting the appropriate lines in the sys crontab. The sa1 program stores performance data in the /var/adm/sa directory. sa2 writes reports from this data, and sadc is a more general version of sa1.

In practice, I do not find that the sa2-produced reports are terribly useful in most cases. Depending on the issue being examined, it may be sufficient to run sa1 at intervals that can be set in the sys crontab.

Alternatively, sar can be used on the command line to look at performance over different time slices or over a constricted period of time:

sar -A -o outfile 5 2000

(Here, "5" represents the time slice and "2000" represents the number of samples to be taken. "outfile" is the output file where the data will be stored.)

The data from this file can be read by using the "-f" option (see below).

System Activity Reporter

sar has several options that allow it to process the data collected by sa1 in different ways:

• -a: Reports file system access statistics. Can be used to look at issues related to the DNLC.


• iget/s: Rate of requests for inodes not in the DNLC. An iget will be issued for each path component of the file's path.


• namei/s: Rate of file system path searches. (If the directory name is not in the DNLC, iget calls are made.)


• dirbk/s: Rate of directory block reads.


• -A: Reports all data.


• -b: Buffer activity reporter:


• bread/s, bwrit/s: Transfer rates (per second) between system buffers and block devices (such as disks).


• lread/s, lwrit/s: System buffer access rates (per second).


• %rcache, %wcache: Cache hit rates (%).


• pread/s, pwrit/s: Transfer rates between system buffers and character devices.


• -c: System call reporter:


• scall/s: System call rate (per second).


• sread/s, swrit/s, fork/s, exec/s: Call rate for these calls (per second).


• rchar/s, wchar/s: Transfer rate (characters per second).


• -d: Disk activity (actually, block device activity):


• %busy: % of time servicing a transfer request.


• avque: Average number of outstanding requests.


• r+w/s: Rate of reads+writes (transfers per second).


• blks/s: Rate of 512-byte blocks transferred (per second).


• avwait: Average wait time (ms).


• avserv: Average service time (ms). (For block devices, this includes seek rotation and data transfer times. Note that the iostat svc_t is equivalent to the avwait+avserv.)


• -e HH:MM: CPU useage up to time specified.


• -f filename: Use filename as the source for the binary sar data. The default is to use today's file from /var/adm/sa.


• -g: Paging activity (see "Paging" for more details):
  
  
  • pgout/s: Page-outs (requests per second).
  
  
  • ppgout/s: Page-outs (pages per second).
  
  
  • pgfree/s: Pages freed by the page scanner (pages per second).
  
  
  • pgscan/s: Scan rate (pages per second).
  
  
  • %ufs_ipf: Percentage of UFS inodes removed from the free list while still pointing at reuseable memory pages. This is the same as the percentage of igets that force page flushes.
  
  
  
  
• -i sec: Set the data collection interval to i seconds.


• -k: Kernel memory allocation:


• sml_mem: Amount of virtual memory available for the small pool (bytes). (Small requests are less than 256 bytes)


• lg_mem: Amount of virtual memory available for the large pool (bytes). (512 bytes-4 Kb)


• ovsz_alloc: Memory allocated to oversize requests (bytes). Oversize requests are dynamically allocated, so there is no pool. (Oversize requests are larger than 4 Kb)


• alloc: Amount of memory allocated to a pool (bytes). The total KMA useage is the sum of these columns.


• fail: Number of requests that failed.


• -m: Message and semaphore activities.


• msg/s, sema/s: Message and semaphore statistics (operations per second).


• -o filename: Saves output to filename.


• -p: Paging activities.


• atch/s: Attaches (per second). (This is the number of page faults that are filled by reclaiming a page already in memory.)


• pgin/s: Page-in requests (per second) to file systems.


• ppgin/s: Page-ins (per second). (Multiple pages may be affected by a single request.)


• pflt/s: Page faults from protection errors (per second).


• vflts/s: Address translation page faults (per second). (This happens when a valid page is not in memory. It is comparable to the vmstat-reported page/mf value.)


• slock/s: Faults caused by software lock requests that require physical I/O (per second).


• -q: Run queue length and percentage of the time that the run queue is occupied.


• -r: Unused memory pages and disk blocks.


• freemem: Pages available for use (Use pagesize to determine the size of the pages).


• freeswap: Disk blocks available in swap (512-byte blocks).


• -s time: Start looking at data from time onward.


• -u: CPU utilization.


• %usr: User time.


• %sys: System time.


• %wio: Waiting for I/O (does not include time when another process could be schedule to the CPU).


• %idle: Idle time.


• -v: Status of process, inode, file tables.


• proc-sz: Number of process entries (proc structures) currently in use, compared with max_nprocs.


• inod-sz: Number of inodes in memory compared with the number currently allocated in the kernel.


• file-sz: Number of entries in and size of the open file table in the kernel.


• lock-sz: Shared memory record table entries currently used/allocated in the kernel. This size is reported as 0 for standards compliance (space is allocated dynamically for this purpose).


• ov: Overflows between sampling points.


• -w: System swapping and switching activity.


• swpin/s, swpot/s, bswin/s, bswot/s: Number of LWP transfers or 512-byte blocks per second.


• pswch/s: Process switches (per second).


• -y: TTY device activity.


• rawch/s, canch/s, outch/s: Input character rate, character rate processed by canonical queue, output character rate.


• rcvin/s, xmtin/s, mdmin/s: Receive, transmit and modem interrupt rates.