Use the sar command to do the following:
Organize and view data about system activity
Access system activity data on a special request basis
Generate automatic reports to measure and monitor system performance, and special request reports to pinpoint specific performance problems. Collecting System Activity Data Automatically (sar) describes these tools.
For a detailed description of this command, see sar(1).
Display file access operation statistics with the sar -a command.
$ sar -a SunOS venus 5.9 Generic sun4u 06/24/2001 00:00:00 iget/s namei/s dirbk/s 01:00:00 0 0 0 02:00:02 0 0 0 03:00:00 0 1 0 04:00:00 0 0 0 05:00:01 0 0 0 06:00:00 0 0 0 Average 0 1 0 |
The following table describes the operating system routines that are reported by the sar -a command.
Table 24–7 Output from the sar -a Command
Field Name |
Description |
---|---|
iget/s |
The number of requests made for inodes that were not in the directory name look-up cache (DNLC). |
namei/s |
The number of file system path searches per second. If namei does not find a directory name in the DNLC, it calls iget to get the inode for either a file or directory. Hence, most igets are the result of DNLC misses. |
dirbk/s |
The number of directory block reads issued per second. |
The larger the reported values, the more time the kernel is spending to access user files. The amount of time reflects how heavily programs and applications are using the file systems. The -a option is helpful for viewing how disk-dependent an application is.
Display buffer activity statistics with the sar -b command.
The buffer is used to cache metadata, which includes inodes, cylinder group blocks, and indirect blocks.
$ sar -b 00:00:00 bread/s lread/s %rcache bwrit/s lwrit/s %wcache pread/s pwrit/s 01:00:00 0 0 100 0 0 55 0 0 |
The following table describes the buffer activities that are displayed by the -b option.
Table 24–8 Output From the sar -b Command
Field Name |
Description |
---|---|
bread/s |
Average number of reads per second that are submitted to the buffer cache from the disk |
lread/s |
Average number of logical reads per second from the buffer cache |
%rcache |
Fraction of logical reads that are found in the buffer cache (100% minus the ratio of bread/s to lread/s) |
bwrit/s |
Average number of physical blocks (512 blocks) that are written from the buffer cache to disk, per second |
lwrit/s |
Average number of logical writes to the buffer cache, per second |
%wcache |
Fraction of logical writes that are found in the buffer cache (100% minus the ratio of bwrit/s to lwrit/s) |
pread/s |
Average number of physical reads, per second that use character device interfaces |
pwrit/s |
Average number of physical write requests, per second that use character device interfaces |
The most important entries are the cache hit ratios %rcache and %wcache, which measure the effectiveness of system buffering. If %rcache falls below 90 percent, or if %wcache falls below 65 percent, it might be possible to improve performance by increasing the buffer space.
The following abbreviated example of sar -b output shows that the %rcache and %wcache buffers are not causing any slowdowns. All the data is within acceptable limits.
$ sar -b SunOS venus 5.9 Generic sun4u 06/24/2001 00:00:00 bread/s lread/s %rcache bwrit/s lwrit/s %wcache pread/s pwrit/s 01:00:00 0 0 100 0 0 55 0 0 02:00:02 0 0 100 0 0 55 0 0 03:00:00 0 0 100 0 0 72 0 0 04:00:00 0 0 100 0 0 56 0 0 05:00:01 0 0 100 0 0 55 0 0 06:00:00 0 0 100 0 0 55 0 0 Average 0 0 94 0 0 64 0 0 |
Display system call statistics by using the sar -c command.
$ sar -c 00:00:00 scall/s sread/s swrit/s fork/s exec/s rchar/s wchar/s 01:00:00 38 2 2 0.00 0.00 149 120 |
The following table describes the system call categories that are reported by the -c option. Typically, reads and writes account for about half of the total system calls, although the percentage varies greatly with the activities that are being performed by the system.
Table 24–9 Output From the sar -c Command
Field Name |
Description |
---|---|
scall/s |
All types of system calls per second (generally about 30 per second on a system with 4 to 6 users). |
sread/s |
read system calls per second. |
swrit/s |
write system calls per second. |
fork/s |
fork system calls per second (about 0.5 per second on a system with 4 to 6 users). This number will increase if shell scripts are running. |
exec/s |
exec system calls per second. If exec/s divided by fork/s is greater than three, look for inefficient PATH variables. |
rchar/s |
Characters (bytes) transferred by read system calls per second. |
wchar/s |
Characters (bytes) transferred by write system calls per second. |
The following abbreviated example shows output from the sar -c command.
$ sar -c SunOS venus 5.9 Generic sun4u 06/24/2001 00:00:00 scall/s sread/s swrit/s fork/s exec/s rchar/s wchar/s 01:00:00 38 2 2 0.00 0.00 149 120 02:00:02 38 2 2 0.00 0.00 149 120 03:00:00 42 2 2 0.05 0.05 218 147 04:00:00 39 2 2 0.01 0.00 155 123 05:00:01 38 2 2 0.00 0.00 150 120 06:00:00 38 2 2 0.01 0.00 149 120 Average 50 4 3 0.02 0.02 532 238 |
Display disk activity statistics with the sar -d command.
$ sar -d 00:00:00 device %busy avque r+w/s blks/s avwait avserv 01:00:00 fd0 0 0.0 0 0 0.0 0.0 |
The following table describes the disk device activities that are reported by the -d option.
Table 24–10 Output From the sar -d Command
Field Name |
Description |
---|---|
device |
Name of the disk device that is being monitored |
%busy |
Percentage of time the device spent servicing a transfer request |
avque |
The sum of the average wait time plus the average service time |
r+w/s |
Number of read and write transfers to the device, per second |
blks/s |
Number of 512-byte blocks that are transferred to the device, per second |
avwait |
Average time, in milliseconds, that transfer requests wait idly in the queue (measured only when the queue is occupied) |
avserv |
Average time, in milliseconds, for a transfer request to be completed by the device (for disks, this value includes seek, rotational latency, and data transfer times) |
Note that queue lengths and wait times are measured when there is something in the queue. If %busy is small, large queues and service times probably represent the periodic efforts by the system to ensure that altered blocks are promptly written to the disk.
This abbreviated example illustrates the sar -d output.
$ sar -d SunOS venus 5.9 Generic sun4u 06/24/2001 00:00:00 device %busy avque r+w/s blks/s avwait avserv 01:00:00 fd0 0 0.0 0 0 0.0 0.0 nfs1 0 0.0 0 0 0.0 0.0 sd0 0 0.0 0 0 0.0 39.6 sd0,a 0 0.0 0 0 0.0 39.6 sd0,b 0 0.0 0 0 0.0 0.0 sd0,c 0 0.0 0 0 0.0 0.0 sd0,f 0 0.0 0 0 0.0 0.0 sd0,g 0 0.0 0 0 0.0 0.0 sd0,h 0 0.0 0 0 0.0 0.0 sd6 0 0.0 0 0 0.0 0.0 |
Use the sar -g command to display page-out and memory freeing activities (in averages).
$ sar -g 00:00:00 pgout/s ppgout/s pgfree/s pgscan/s %ufs_ipf 01:00:00 0.00 0.00 0.00 0.00 0.00 |
The output displayed by the sar -g command is a good indicator of whether more memory may be needed. Use the ps -elf command to show the number of cycles that are used by the page daemon. A high number of cycles, combined with high values for pgfree/s and pgscan/s, indicates a memory shortage.
The sar -g command also shows whether inodes are being recycled too quickly and causing a loss of reusable pages.
The following table describes the output from the -g option.
Table 24–11 Output From the sar -g Command
Field Name |
Description |
---|---|
pgout/s |
The number of page-out requests per second. |
ppgout/s |
The actual number of pages that are paged-out, per second. A single page-out request might involve paging-out multiple pages. |
pgfree/s |
The number of pages, per second, that are placed on the free list. |
pgscan/s |
The number of pages, per second, that are scanned by the page daemon. If this value is high, the page daemon is spending a lot of time checking for free memory. This situation implies that more memory might be needed. |
%ufs_ipf |
The percentage of ufs inodes taken off the free list by iget that had reusable pages associated with them. These pages are flushed and cannot be reclaimed by processes. Thus, this field represents the percentage of igets with page flushes. A high value indicates that the free list of inodes is page-bound, and the number of ufs inodes might need to be increased. |
The following abbreviated example shows output from the sar -g command.
$ sar -g SunOS venus 5.9 Generic sun4u 06/24/2001 00:00:00 pgout/s ppgout/s pgfree/s pgscan/s %ufs_ipf 01:00:00 0.00 0.00 0.00 0.00 0.00 02:00:02 0.00 0.00 0.00 0.00 0.00 03:00:00 0.00 0.01 0.01 0.00 0.00 04:00:00 0.00 0.00 0.00 0.00 0.00 05:00:01 0.00 0.00 0.00 0.00 0.00 06:00:00 0.00 0.00 0.00 0.00 0.00 Average 0.01 0.12 0.21 0.66 0.00 |
Use the sar -k command to report on the following activities of the Kernel Memory Allocator (KMA).
The KMA allows a kernel subsystem to allocate and free memory as needed. Rather than statically allocating the maximum amount of memory it is expected to require under peak load, the KMA divides requests for memory into three categories: small (less than 256 bytes), large (512 bytes to 4 Kbytes), and oversized (greater than 4 Kbytes). The KMA keeps two pools of memory to satisfy small and large requests. The oversized requests are satisfied by allocating memory from the system page allocator.
If you are investigating a system that is being used to write drivers or STREAMS that use KMA resources, then the sar -k command will likely prove useful. Otherwise, you will probably not need the information it provides. Any driver or module that uses KMA resources, but does not specifically return the resources before it exits, can create a memory leak. A memory leak causes the amount of memory that is allocated by KMA to increase over time. Thus, if the alloc fields of the sar -k command increase steadily over time, there might be a memory leak. Another indication of a memory leak is failed requests. If this problem occurs, a memory leak has probably caused KMA to be unable to reserve and allocate memory.
If it appears that a memory leak has occurred, you should check any drivers or STREAMS that might have requested memory from KMA and not returned it.
$ sar -k 00:00:00 sml_mem alloc fail lg_mem alloc fail ovsz_alloc fail 01:00:00 2523136 1866512 0 18939904 14762364 0 360448 0 02:00:02 2523136 1861724 0 18939904 14778748 0 360448 0 |
The following table describes the output from the -k option.
Table 24–12 Output From the sar -k Command
Field Name |
Description |
---|---|
sml_mem |
The amount of memory, in bytes, that the KMA has available in the small memory request pool (a small request is less than 256 bytes). |
alloc |
The amount of memory, in bytes, that the KMA has allocated from its small memory request pool to small memory requests. |
fail |
The number of requests for small amounts of memory that failed. |
lg_mem |
The amount of memory, in bytes, that the KMA has available in the large memory request pool (a large request is from 512 bytes to 4 Kbytes). |
alloc |
The amount of memory, in bytes, that the KMA has allocated from its large memory request pool to large memory requests. |
fail |
The number of failed requests for large amounts of memory |
ovsz_alloc |
The amount of memory that is allocated for oversized requests (those requests that are greater than 4 Kbytes). These requests are satisfied by the page allocator. Thus, there is no pool. |
fail |
The number of failed requests for oversized amounts of memory. |
The following is an abbreviated example of sar -k output.
$ sar -k SunOS venus 5.9 Generic sun4u 06/24/2001 00:00:00 sml_mem alloc fail lg_mem alloc fail ovsz_alloc fail 01:00:00 2523136 1866512 0 18939904 14762364 0 360448 0 02:00:02 2523136 1861724 0 18939904 14778748 0 360448 0 03:00:00 2523136 1865664 0 18939904 14745884 0 360448 0 04:00:00 2523136 1867692 0 18939904 14746616 0 360448 0 05:00:01 2523136 1867208 0 18939904 14763700 0 360448 0 06:00:00 2523136 1867772 0 18939904 14779444 0 360448 0 Average 2724096 1791806 0 20089344 15434591 0 360448 0 |
Use the sar -m command to report interprocess communication activities.
$ sar -m 00:00:00 msg/s sema/s 01:00:00 0.00 0.00 |
These figures will usually be zero (0.00), unless you are running applications that use messages or semaphores.
The following table describes the output from the -m option.
Table 24–13 Output From the sar -m Command
Field Name |
Description |
---|---|
msg/s |
The number of message operations (sends and receives) per second |
sema/s |
The number of semaphore operations per second |
The following abbreviated example shows output from the sar -m command.
$ sar -m SunOS venus 5.9 Generic sun4u 06/24/2001 00:00:00 msg/s sema/s 01:00:00 0.00 0.00 02:00:02 0.00 0.00 03:00:00 0.00 0.00 04:00:00 0.00 0.00 05:00:01 0.00 0.00 06:00:00 0.00 0.00 Average 0.00 0.00 |
Use the sar -p command to report page-in activity which includes protection and translation faults.
$ sar -p 00:00:00 atch/s pgin/s ppgin/s pflt/s vflt/s slock/s 01:00:00 0.07 0.00 0.00 0.21 0.39 0.00 |
The following table describes the reported statistics from the -p option.
Table 24–14 Output From the sar -p Command
Field Name |
Description |
---|---|
atch/s |
The number of page faults, per second, that are satisfied by reclaiming a page currently in memory (attaches per second). Instances include reclaiming an invalid page from the free list and sharing a page of text that is currently being used by another process (for example, two or more processes that are accessing the same program text). |
pgin/s |
The number of times, per second, that file systems receive page-in requests. |
ppgin/s |
The number of pages paged in, per second. A single page-in request, such as a soft-lock request (see slock/s), or a large block size, might involve paging-in multiple pages. |
pflt/s |
The number of page faults from protection errors. Instances of protection faults are illegal access to a page and “copy-on-writes.” Generally, this number consists primarily of “copy-on-writes.” |
vflt/s |
The number of address translation page faults, per second. These faults are known as validity faults, and occur when a valid process table entry does not exist for a given virtual address. |
slock/s |
The number of faults, per second, caused by software lock requests that require physical I/O. An example of the occurrence of a soft-lock request is the transfer of data from a disk to memory. The system locks the page that is to receive the data, so that it cannot be claimed and used by another process. |
The following abbreviated example shows output from the sar -p command.
$ sar -p SunOS venus 5.9 Generic sun4u 06/24/2001 00:00:00 atch/s pgin/s ppgin/s pflt/s vflt/s slock/s 01:00:00 0.07 0.00 0.00 0.21 0.39 0.00 02:00:02 0.07 0.00 0.00 0.21 0.39 0.00 03:00:00 0.32 0.00 0.00 1.10 2.48 0.00 04:00:00 0.09 0.00 0.00 0.32 0.57 0.00 05:00:01 0.07 0.00 0.00 0.21 0.39 0.00 06:00:00 0.07 0.00 0.00 0.21 0.39 0.00 Average 0.26 0.20 0.30 0.92 1.78 0.00 |
Use the sar -q command to report the average queue length while the queue is occupied, and the percentage of time that the queue is occupied.
$ sar -q 00:00:00 runq-sz %runocc swpq-sz %swpocc |
The number of LWPs swapped out might be greater than zero even if the system has an abundance of free memory. This situation happens when a sleeping LWP is swapped out and has not been awakened (for example, a process or LWP is sleeping, waiting for keyboard or mouse input).
The following table describes the output from the -q option.
Table 24–15 Output From the sar -q Command
Field Name |
Description |
---|---|
runq-sz |
The number of kernel threads in memory that are waiting for a CPU to run. Typically, this value should be less than 2. Consistently higher values mean that the system might be CPU-bound. |
%runocc |
The percentage of time that the dispatch queues are occupied. |
swpq-sz |
The average number of swapped out LWPs. |
%swpocc |
The percentage of time LWPs are swapped out. |
The following abbreviated example shows output from the sar -q command. If %runocc is high (greater than 90 percent) and runq-sz is greater than 2, the CPU is heavily loaded and response is degraded. In this case, additional CPU capacity might be required to obtain acceptable system response.
$ sar -q SunOS venus 5.9 Generic sun4u 06/24/2001 08:45:18 runq-sz %runocc swpq-sz %swpocc 08:45:18 unix restarts 09:00:00 1.0 0 0.0 0 09:20:00 0.0 0 0.0 0 09:40:00 0.0 0 0.0 0 Average 1.0 0 0.0 0 |
Use the sar -r command to report the number of memory pages and swap-file disk blocks that are currently unused.
$ sar -r 00:00:00 freemem freeswap 01:00:00 2135 401922 |
The following table describes the output from the -r option.
Table 24–16 Output From the sar -r Command
Field Name |
Description |
---|---|
freemem |
The average number of memory pages that are available to user processes over the intervals sampled by the command. Page size is machine-dependent. |
freeswap |
The number of 512-byte disk blocks that are available for page swapping. |
The following example shows output from the sar -r command.
$ sar -r SunOS venus 5.9 Generic sun4u 06/24/2001 00:00:00 freemem freeswap 01:00:00 2135 401922 02:00:02 2137 401949 03:00:00 2137 402006 04:00:00 2139 401923 05:00:01 2138 402033 06:00:00 2137 401919 Average 2500 399914 |
Use the sar -u command to display CPU utilization statistics.
$ sar -u 00:00:00 %usr %sys %wio %idle 01:00:00 0 0 0 100 |
The sar command without any options is equivalent to sar -u. At any given moment, the processor is either busy or idle. When busy, the processor is in either user mode or system mode. When idle, the processor is either waiting for I/O completion or “sitting still” with no work to do.
The following table describes output from the -u option.
Table 24–17 Output From the sar -u Command
Field Name |
Description |
---|---|
%usr |
Lists the percentage of time that the processor is in user mode |
%sys |
Lists the percentage of time that the processor is in system mode |
%wio |
Lists the percentage of time that the processor is idle and waiting for I/O completion |
%idle |
Lists the percentage of time that the processor is idle and not waiting for I/O |
A high %wio generally means that a disk slowdown has occurred.
The following example shows output from the sar -u command.
$ sar -u SunOS venus 5.9 Generic sun4u 06/24/2001 00:00:00 %usr %sys %wio %idle 01:00:00 0 0 0 100 02:00:02 0 0 0 100 03:00:00 0 0 0 100 04:00:00 0 0 0 100 05:00:01 0 0 0 100 06:00:00 0 0 0 100 07:00:00 0 0 0 100 08:00:01 0 0 0 100 08:20:00 0 0 0 100 08:40:00 0 0 0 100 09:00:00 0 0 0 100 09:20:00 0 0 0 100 09:40:00 0 0 0 100 10:00:00 0 0 0 100 10:20:00 0 0 0 100 10:40:01 0 0 0 100 11:00:00 5 2 10 82 Average 0 0 0 100 |
Use the sar -v command to report the status of the process table, inode table, file table, and shared memory record table.
$ sar -v 00:00:00 proc-sz ov inod-sz ov file-sz ov lock-sz 01:00:00 43/922 0 2984/4236 0 322/322 0 0/0 |
Output from the -v option is described in the following table.
Table 24–18 Output From the sar -v Command
Field Name |
Description |
---|---|
proc-sz |
The number of process entries (proc structures) that are currently being used, or allocated in the kernel. |
inod-sz |
The total number of inodes in memory verses the maximum number of inodes that are allocated in the kernel. This number is not a strict high water mark; it can overflow. |
file-sz |
The size of the open system file table. The sz is given as 0, since space is allocated dynamically for the file table. |
ov |
The number of shared memory record table entries that are currently being used or allocated in the kernel. The sz is given as 0 because space is allocated dynamically for the shared memory record table. |
lock-sz |
The number of shared memory record table entries that are currently being used or allocated in the kernel. The sz is given as 0 because space is allocated dynamically for the shared memory record table. |
The following abbreviated example shows output from the sar -v command. This example shows that all tables are large enough to have no overflows. These tables are all dynamically allocated based on the amount of physical memory.
$ sar -v SunOS venus 5.9 Generic sun4u 06/24/2001 00:00:00 proc-sz ov inod-sz ov file-sz ov lock-sz 01:00:00 43/922 0 2984/4236 0 322/322 0 0/0 02:00:02 43/922 0 2984/4236 0 322/322 0 0/0 03:00:00 43/922 0 2986/4236 0 323/323 0 0/0 04:00:00 43/922 0 2987/4236 0 322/322 0 0/0 05:00:01 43/922 0 2987/4236 0 322/322 0 0/0 06:00:00 43/922 0 2987/4236 0 322/322 0 0/0 |
Use the sar -w command to report swapping and switching activity.
$ sar -w 00:00:00 swpin/s bswin/s swpot/s bswot/s pswch/s 01:00:00 0.00 0.0 0.00 0.0 22 |
The following table describes target values and observations.
Table 24–19 Output From the sar -w Command
Field Name |
Description |
---|---|
swpin/s |
The number of LWP transfers into memory per second. |
bswin/s |
The average number of processes that are swapped out of memory per second. If the number is greater than 1, you might need to increase memory. |
swpot/s |
The average number of processes that are swapped out of memory per second. If the number is greater than 1, you might need to increase memory. |
bswot/s |
The number of blocks that are transferred for swap-outs per second. |
pswch/s |
The number of kernel thread switches, per second. |
All process swap-ins include process initialization.
The following example shows output from the sar -w command.
$ sar -w SunOS venus 5.9 Generic sun4u 06/24/2001 00:00:00 swpin/s bswin/s swpot/s bswot/s pswch/s 01:00:00 0.00 0.0 0.00 0.0 22 02:00:02 0.00 0.0 0.00 0.0 22 03:00:00 0.00 0.0 0.00 0.0 22 04:00:00 0.00 0.0 0.00 0.0 22 05:00:01 0.00 0.0 0.00 0.0 22 06:00:00 0.00 0.0 0.00 0.0 22 07:00:00 0.00 0.0 0.00 0.0 22 08:00:01 0.00 0.0 0.00 0.0 22 08:20:00 0.00 0.0 0.00 0.0 22 08:40:00 0.00 0.0 0.00 0.0 22 09:00:00 0.00 0.0 0.00 0.0 22 09:20:00 0.00 0.0 0.00 0.0 22 09:40:00 0.00 0.0 0.00 0.0 22 10:00:00 0.00 0.0 0.00 0.0 22 10:20:00 0.00 0.0 0.00 0.0 22 10:40:01 0.00 0.0 0.00 0.0 23 11:00:00 0.00 0.0 0.00 0.0 144 Average 0.00 0.0 0.00 0.0 24 |
Use the sar -y command to monitor terminal device activities.
$ sar -y 00:00:00 rawch/s canch/s outch/s rcvin/s xmtin/s mdmin/s 01:00:00 0 0 0 0 0 0 |
If you have a lot of terminal I/O, you can use this report to determine if there are any bad lines. The activities recorded are defined in the following table.
Table 24–20 Output From the sar -y Command
Field Name |
Description |
---|---|
rawch/s |
Input characters (raw queue), per second |
canch/s |
Input characters that are processed by canon (canonical queue), per second |
outch/s |
Output characters (output queue) per second |
rcvin/s |
Receiver hardware interrupts per second |
xmtin/s |
Transmitter hardware interrupts per second |
mdmin/s |
Modem interrupts per second |
The number of modem interrupts per second (mdmin/s) should be close to zero. The receive and transmit interrupts per second (xmtin/s and rcvin/s) should be less than or equal to the number of incoming or outgoing characters, respectively. If this is not the case, check for bad lines.
The following abbreviated example shows output from the sar -y command.
$ sar -y SunOS venus 5.9 Generic sun4u 06/24/2001 00:00:00 rawch/s canch/s outch/s rcvin/s xmtin/s mdmin/s 01:00:00 0 0 0 0 0 0 02:00:02 0 0 0 0 0 0 03:00:00 0 0 0 0 0 0 04:00:00 0 0 0 0 0 0 05:00:01 0 0 0 0 0 0 06:00:00 0 0 0 0 0 0 07:00:00 0 0 0 0 0 0 08:00:01 0 0 0 0 0 0 08:20:00 0 0 0 0 0 0 08:40:00 0 0 0 0 0 0 09:00:00 0 0 0 0 0 0 09:20:00 0 0 0 0 0 0 09:40:00 0 0 0 0 0 0 10:00:00 0 0 0 0 0 0 10:20:00 0 0 0 0 0 0 10:40:01 0 0 20 0 0 0 Average 0 0 3 0 0 0 |
Use the sar -A command to display statistics from all options to provide a view of overall system performance.
This command provides a more global perspective. If data from more than a single time segment is shown, the report includes averages.