System Administration Guide: Advanced Administration

Collecting System Activity Data Automatically (sar)

Three commands are involved in the automatic collection of system activity data: sadc, sa1, and sa2.

The sadc data collection utility periodically collects data on system activity and saves the data in a file in binary format, one file for each 24-hour period. You can set up the sadc command to run periodically (usually once each hour), and whenever the system boots to multiuser mode. The data files are placed in the /var/adm/sa directory. Each file is named sadd, where dd is the current date. The format of the command is as follows:

/usr/lib/sa/sadc [t n] [ofile]

The command samples n times with an interval of t seconds, which should be greater than five seconds between samples. This command then writes to the binary ofile file, or to standard output.

Running the sadc Command When Booting

The sadc command should be run at system boot time to record the statistics from when the counters are reset to zero. To make sure that the sadc command is run at boot time, the svcadm enable system/sar:default command writes a record to the daily data file.

The command entry has the following format:

/usr/bin/su sys -c "/usr/lib/sa/sadc /var/adm/sa/sa`date +%d`"

Running the sadc Command Periodically With the sa1 Script

To generate periodic records, you need to run the sadc command regularly. The simplest way to do so is to uncomment the following lines in the /var/spool/cron/crontabs/sys file:

# 0 * * * 0-6 /usr/lib/sa/sa1
# 20,40 8-17 * * 1-5 /usr/lib/sa/sa1
# 5 18 * * 1-5 /usr/lib/sa/sa2 -s 8:00 -e 18:01 -i 1200 -A

The sys crontab entries do the following:

You can change these defaults to meet your needs.

Producing Reports With the sa2 Shell Script

Another shell script, sa2, produces reports rather than binary data files. The sa2 command invokes the sar command and writes the ASCII output to a report file.

Setting Up Automatic Data Collection (sar)

The sar command can be used either to gather system activity data itself or to report what has been collected in the daily activity files that are created by the sadc command.

The sar command has the following formats:

sar [-aAbcdgkmpqruvwy] [-o file] t [n] 

sar [-aAbcdgkmpqruvwy] [-s time] [-e time] [-i sec] [-f file]

The following sar command samples cumulative activity counters in the operating system every t seconds, n times. The t should be five seconds or greater. Otherwise, the command itself might affect the sample. You must specify a time interval in which to take the samples. Otherwise, the command operates according to the second format. The default value of n is 1. The following example takes two samples separated by 10 seconds. If the -o option were specified, samples are saved in binary format.

$ sar -u 10 2

Other important information about the sar command includes the following:

The following table lists the sar options and their actions.

Table 13–2 Options for the sar Command




Checks file access operations 


Checks buffer activity  


Checks system calls  


Checks activity for each block device 


Checks page-out and memory freeing  


Checks kernel memory allocation  


Checks interprocess communication  


Checks system table status  


Checks swap and dispatch activity  


Checks queue activity  


Checks unused memory  


Checks CPU utilization 


Checks swapping and switching volume  


Checks terminal activity  


Reports overall system performance, which is the same as entering all options. 

Using no option is equivalent to calling the sar command with the -u option.

ProcedureHow to Set Up Automatic Data Collection

  1. Become superuser or assume an equivalent role.

    Roles contain authorizations and privileged commands. For more information about roles, see Configuring RBAC (Task Map) in System Administration Guide: Security Services.

  2. Run the svcadm enable system/sar:default command.

    This version of the sadc command writes a special record that marks the time when the counters are reset to zero (boot time).

  3. Edit the /var/spool/cron/crontabs/sys crontab file.

    Note –

    Do not edit a crontab file directly. Instead, use the crontab -e command to make changes to an existing crontab file.

    # crontab -e sys
  4. Uncomment the following lines:

    0 * * * 0-6 /usr/lib/sa/sa1
    20,40 8-17 * * 1-5 /usr/lib/sa/sa1
    5 18 * * 1-5 /usr/lib/sa/sa2 -s 8:00 -e 18:01 -i 1200 -A

    For more information, see the crontab(1) man page.