Shulou(Shulou.com)06/01 Report--

This article introduces the relevant knowledge of "the operation method of monitoring system with sar command in Linux". In the operation of actual cases, many people will encounter such a dilemma, so let the editor lead you to learn how to deal with these situations. I hope you can read it carefully and be able to achieve something!

Sar (System Activity Reporter system activity report) is one of the most comprehensive system performance analysis tools on Linux, which can report system activities from many aspects.

It includes: the reading and writing of files, the usage of system calls, disk I _ Dot O, CPU efficiency, memory usage, process activities and IPC-related activities.

This paper mainly introduces the sar command by taking CentOS 6.3x64 system as an example.

1. Common format of sar command

Sar [options] [- A] [- o file] t [n]

Where:

T is the sampling interval, n is the number of samples, and the default value is 1

-o file means to store the result of the command in a file in binary format, where file is the file name.

Options is a command line option, and the common options for sar commands are as follows:

-A: the sum of all reports

-P: set CPU

-u: output statistics on CPU usage

-v: output statistics for inode, files, and other kernel tables

-d: output activity information for each block device

-n: report on the network

-Q: report queue length and load information

-r: output memory and swap space statistics

-b: displays statistics for Ihammer O and transfer rate

-a: reading and writing of documents

-c: output process statistics, number of processes created per second

-R: output statistics for memory pages

-y: terminal device activity

-w: output system exchange activity information

2. CPU resource monitoring

For example, to sample every 10 seconds, for 3 consecutive times, to observe the usage of CPU, and to store the sampling results in the file sys_info in the current directory in binary form, type the following command:

The code is as follows:

Sar-u-o sys_info 10 3

The screen displays as follows:

17:06:16 CPU user nice system iowait steal idle

17:06:26 all 0.00 0.00 0.20 0.00 0.00 99.80

17:06:36 all 0.00 0.00 0.20 0.00 0.00 99.80

17:06:46 all 0.00 0.00 0.10 0.00 0.00 99.90

Average: all 0.00 0.00 0.17 0.00 0.00 99.83

Output item description:

CPU:all indicates that the statistics are the average of all CPU.

% user: displays the percentage of total time spent using CPU running at the user level (application).

% nice: the percentage of total CPU time spent on nice operations displayed at the user level.

% system: the percentage of total time spent running CPU at the core level (kernel).

% iowait: displays the percentage of total CPU time spent waiting for the IUnip O operation.

% steal: the percentage that the hypervisor (hypervisor) waits for the virtual CPU while serving another virtual process.

% idle: displays the percentage of total CPU time occupied by CPU idle time.

Note:

(1)。 If the value of% iowait is too high, it indicates that there is a bottleneck in the hard disk.

(2)。 If the value of% idle is high but the system response is slow, it is possible that CPU is waiting to allocate memory. At this time, the memory capacity should be increased.

(3)。 If the value of% idle is consistently lower than 1, the CPU processing capacity of the system is relatively low, indicating that the resource that needs to be solved most in the system is CPU.

Because sys_info is the content of the binary file, when you use cat to read sys_info, you will find that it is all garbled, hehe, don't worry, sar has prepared the-f filename option for you, as long as you use-f to set the information to be read in the storage file, you can read the information clearly.

such as

The code is as follows:

Sar-f sys_info

.

If my CPU is a multi-core processor, can sar know the operation information of a certain core?

No problem at all. There is an option-P, which is designed for multicore processors.

When using the sar command without setting the-P option, sar will give a macro report, that is, the average value, based on all cores.

If the-P option is used to specify a core, specific performance information is given for that individual core.

When using-P ALL, sar gives specific performance information based on each core, and then gives an overall performance information.

For example, I have a very strong processor CPU, which is a dual-core CPU. Take a look at how to use-P:

The code is as follows:

Sar-P ALL 1 1

Linux 2.6.9 10/16/2009

10:59:38 PM CPU user nice system iowait idle

10:59:39 PM all 2.12 0.00 2.87 0.00 95.01

10:59:39 PM 0 0.00 0.00 1.98 0.00 98.02

10:59:39 PM 1 9.00 0.00 7.00 0.00 84.00

Sar gives performance information based on each core of the processor. When we want to view the information about the sixth core, the output is as follows:

The code is as follows:

Sar-P 0 1 1

3. Inode, file and other kernel table monitoring

For example, to observe the status of the core table by sampling every 10 seconds for 3 consecutive times, type the following command:

The code is as follows:

Sar-v 10 3

The screen displays as follows:

17:10:49 dentunusd file-nr inode-nr pty-nr

17:10:59 6301 5664 12037 4

17:11:09 6301 5664 12037 4

17:11:19 6301 5664 12037 4

Average: 6301 5664 12037 4

Output item description:

Dentunusd: the number of unused entries in the directory cache

File-nr: number of file handles (file handle) used

Inode-nr: number of index node handles (inode handle) used

Pty-nr: number of pty used

4. Memory and swap space monitoring

For example, sample every 10 seconds, sample 3 times in a row, and monitor memory paging:

The code is as follows:

Sar-r 10 3

The screen displays as follows:

10:02:52 PM kbmemfree kbmemused memused kbbuffers kbcached kbcommit commit

10:03:02 PM 2289016 1632096 41.62 204860 1218352 333068 8.49

10:03:12 PM 2288388 1632724 41.64 204860 1218352 333068 8.49

10:03:22 PM 2288544 1632568 41.64 204860 1218352 333068 8.49

Average: 2288649 1632463 41.63 204860 1218352 333068 8.49

Output item description:

Kbmemfree: this value is basically the same as the free value in the free command, so it does not include buffer and cache space.

Kbmemused: this value is basically the same as the used value in the free command, so it includes buffer and cache space.

% memused: this value is a percentage of kbmemused and total memory (excluding swap).

Kbbuffers and kbcached: these two values are buffer and cache in the free command.

Kbcommit: guarantee the memory needed by the current system, that is, the memory needed to ensure that it does not overflow (RAM+swap).

% commit: this value is a percentage of kbcommit to total memory (including swap).

5. Memory paging monitoring

For example, sample every 10 seconds, sample 3 times in a row, and monitor memory paging:

The code is as follows:

Sar-B 10 3

The screen displays as follows:

Output item description:

Pgpgin/s: indicates the number of bytes per second from disk or SWAP to memory (KB)

Pgpgout/s: indicates the number of bytes per second from memory to disk or SWAP (KB)

Fault/s: the number of missing pages generated by the system per second, that is, the sum of primary and secondary missing pages (major + minor)

Majflt/s: the number of main missing pages generated per second.

Pgfree/s: the number of pages placed in the idle queue per second

Pgscank/s: number of pages scanned by kswapd per second

Pgscand/s: the number of pages directly scanned per second

Pgsteal/s: the number of pages cleared from cache per second to meet memory requirements

% vmeff: percentage of pages cleared per second (pgsteal) to total scanned pages (pgscank+pgscand)

6. Icano and transfer rate monitoring

For example, to report buffer usage by sampling every 10 seconds for 3 consecutive times, type the following command:

The code is as follows:

Sar-b 10 3

The screen displays as follows:

18:51:05 tps rtps wtps bread/s bwrtn/s

18:51:15 0.00 0.00 0.00

18:51:25 1.92 0.00 1.92 0.00 22.65

18:51:35 0.00 0.00 0.00

Average: 0.64 0.00 0.64 0.00 7.59

Output item description:

Tps: the total amount of Istroke O transmissions per second of physical devices

Rtps: the total amount of data read from the physical device per second

Wtps: the total amount of data written to the physical device per second

Bread/s: the amount of data read from a physical device per second, in blocks per second

Bwrtn/s: the amount of data written to the physical device per second, in blocks per second

7. Monitoring of process queue length and average load status

For example, sample every 10 seconds, sample 3 times in succession, and monitor the queue length and average load status of the process:

The code is as follows:

Sar-Q 10 3

The screen displays as follows:

19:25:50 runq-sz plist-sz ldavg-1 ldavg-5 ldavg-15

19:26:00 0 259 0.00 0.00 0.00

19:26:10 0 259 0.00 0.00 0.00

19:26:20 0 259 0.00 0.00 0.00

Average: 0 259 0.00 0.00 0.00

Output item description:

Runq-sz: length of the run queue (number of processes waiting to run)

Plist-sz: number of processes (processes) and threads (threads) in the process list

Ldavg-1: average system load in the last minute (System load average)

Ldavg-5: average system load over the past 5 minutes

Ldavg-15: average system load over the past 15 minutes

8. System exchange activity information monitoring

For example, sampling every 10 seconds, sampling 3 times in a row, and the monitoring system exchanges activity information:

The code is as follows:

Sar-W 10 3

The screen displays as follows:

19:39:50 pswpin/s pswpout/s

19:40:00 0.00 0.00

19:40:10 0.00 0.00

19:40:20 0.00 0.00

Average: 0.00 0.00

Output item description:

Pswpin/s: the number of swap pages (swap page) swapped in by the system per second

Pswpout/s: the number of swap pages (swap page) swapped out by the system per second

9. Equipment usage monitoring

For example, to report device usage by sampling every 10 seconds for 3 consecutive times, type the following command:

The code is as follows:

# sar-d 10 3-p

The screen displays as follows:

17:45:54 DEV tps rd_sec/s wr_sec/s avgrq-sz avgqu-sz await svctm util

17:46:04 scd0 0.00 0.00 0.00

17:46:04 sda 0.00 0.00 0.00

17:46:04 vg_livedvd-lv_root 0.00 0.00 0.00

17:46:04 vg_livedvd-lv_swap 0.00 0.00 0.00

Where:

The parameter-p can print out the disk device names such as sda,hdc. If the parameter-p is not used, the device node may be dev8-0dev22-0.

Tps: the number of times per second from the physical disk. Multiple logical requests will be merged into a single disk request, and the size of a transfer is uncertain.

Rd_sec/s: the number of times sectors are read per second.

Wr_sec/s: the number of times sectors are written per second.

Avgrq-sz: the average data size (sector) of each device Istroke O operation.

Avgqu-sz: the average length of the disk request queue.

Await: the average elapsed time of each request, including the waiting time of the request queue, from the request disk operation to the completion of the system processing, in milliseconds (1 second = 1000 milliseconds).

Svctm: the average time the system processes each request, excluding the time spent in the request queue.

% util:I/O requests as a percentage of CPU, the higher the ratio, the more saturated it is.

(1)。 When the value of avgqu-sz is low, the device utilization is high.

(2)。 When the value of% util is close to 100%, the device bandwidth is full.

10. To determine the bottleneck of the system, it is sometimes necessary to combine several sar command options

It is suspected that there is a bottleneck in CPU. You can check it with sar-u and sar-Q.

Memory bottleneck is suspected. Check it with sar-B, sar-r, sar-W, etc.

It is suspected that there is a bottleneck in IBG O, which can be checked by sar-b, sar-u and sar-d.

11. Use sar to do a background monitoring program, which can report the machine performance in real time. Can sar be run in the background?

With the help of the backstage character of linux, don't forget to redirect the standard output. The method is as follows:

The code is as follows:

Sar-o monitor.res interval count > / dev/null 2 > & 1 &

Remember to replace interval and count with the intervals and times you want. In this way, all the performance information is stored in the data file monitor.res in binary format. Just use-f when reading.

12. Analyze the network card traffic by sar

The code is as follows:

Sar-n {DEV | EDEV | NFS | NFSD | SOCK | ALL}

Sar provides six different syntax options to display network information. The-n option uses six different switches: DEV | EDEV | NFS | NFSD | SOCK | ALL. DEV displays network interface information, EDEV displays statistics about network errors, NFS statistics about active NFS clients, NFSD statistics NFS server information, SOCK displays socket information, ALL displays all five switches. They can be used alone or together.

If you use the DEV keyword, sar will report information related to network devices, such as lo,eth0 or eth2, such as

The code is as follows:

# sar-n DEV 2 10

Linux 2.6.18-53.el5PAE (localhost.localdomain) 03 Universe 29 Universe 2009

01:39:40 AM IFACE rxpck/s txpck/s rxbyt/s txbyt/s rxcmp/s txcmp/s rxmcst/s

01:39:42 AM lo 0.00 0.00 0.00

01:39:42 AM eth2 131.34 104.98 119704.48 36110.45 0.00 0.00 0.00

01:39:42 AM sit0 0.00 0.00 0.00

01:39:42 AM IFACE rxpck/s txpck/s rxbyt/s txbyt/s rxcmp/s txcmp/s rxmcst/s

01:39:44 AM lo 0.00 0.00 0.00

01:39:44 AM eth2 168.00 165.50 114496.50 83938.50 0.00 0.00 0.00

01:39:44 AM sit0 0.00 0.00 0.00

IFACE:LAN interface, name of the network device

Rxpck/s: packets received per second

Txpck/s: packets sent per second

Rxbyt/s: bytes received per second

Txbyt/s: bytes sent per second

Rxcmp/s: compressed packets received per second

Txcmp/s: compressed packets sent per second

Rxmcst/s: multicast packets received per second

Using the EDEV keyword, the failure of the network device is reported, for example:

The code is as follows:

# sar-n EDEV 2 10

Linux 2.6.18-53.el5PAE (localhost.localdomain) 03 Universe 29 Universe 2009

01:42:18 AM IFACE rxerr/s txerr/s coll/s rxdrop/s txdrop/s txcarr/s rxfram/s rxfifo/s txfifo/s

01:42:20 AM lo 0.00 0.00 0.00

01:42:20 AM eth2 0.00 0.00 0.00

01:42:20 AM sit0 0.00 0.00 0.00

Name of the IFACE:LAN interface network device

Rxerr/s: bad packets received per second

Txerr/s: bad packets sent per second

Coll/s: collisions per second

Rxdrop/s: the number of received packets discarded per second because the buffer is full

Txdrop/s: the number of sent packets discarded per second because the buffer is full

Txcarr/s: carrier errors per second when sending packets

Rxfram/s: the number of frame alignment errors received per second

Rxfifo/s: number of FIFO overspeed errors per second of packets received

Txfifo/s: the number of FIFO overspeed errors per second of packets sent

Using the SOCK keyword, the socket connection is reported:

The code is as follows:

# sar-n SOCK 2 10

Linux 2.6.18-53.el5PAE (localhost.localdomain) 03 Universe 29 Universe 2009

01:44:32 AM totsck tcpsck udpsck rawsck ip-frag

01:44:34 AM 243 9 8 0 0

01:44:36 AM 242 9 7 0 0

01:44:38 AM 238 9 7 0 0

01:44:40 AM 238 9 7 0 0

Totsck: total number of sockets used

Tcpsck: number of TCP sockets used

Udpsck: number of UDP sockets used

Rawsck: number of raw sockets used

Ip-frag: number of IP segments used

If you use the FULL keyword, it is equivalent to the combination of DEV, EDEV and SOCK

This is the end of the content of "how to monitor the system with sar commands in Linux". Thank you for your reading. If you want to know more about the industry, you can follow the website, the editor will output more high-quality practical articles for you!

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.