Sysstat is a suite of performance monitoring tools for Linux. Its best-known utilities are
sar (System Activity Reporter), iostat (for disk I/O), and mpstat (for per-processor statistics). It is the go-to tool for collecting and analyzing your system's performance history.
Why use sysstat?
- Historical analysis: Unlike
toporhtop, which only show the current state,sarlets you see what happened at a specific point in the past. - Problem diagnosis: Essential for understanding the source of a slowdown (CPU, memory, disk, network?).
- Comprehensive reports: Provides detailed data on nearly every subsystem of the machine.
- Lightweight: Background data collection has a negligible impact on performance.
Prerequisites
- A Linux server (Ubuntu/Debian, CentOS/RHEL, etc.).
- Root access or sudo privileges.
Installation and activation
Step 1: Install the package
# On Debian / Ubuntu
sudo apt-get update
sudo apt-get install -y sysstat
# On CentOS / RHEL
sudo yum install -y sysstat
Step 2: Enable data collection
For sar to be able to record historical data, you need to enable collection via cron. On Debian/Ubuntu, this is done by editing a file:
sudo nano /etc/default/sysstatChange the line ENABLED="false" to:
ENABLED="true"On CentOS/RHEL, the service is usually enabled by default. Restart the service so it picks up the change:
sudo systemctl restart sysstatCollection now runs every 10 minutes via a job in /etc/cron.d/sysstat.
Using the tools
The data is stored in /var/log/sysstat/ in binary files named saXX (where XX is the day of the month).
sar - The main tool
sar is used to display the collected data.
# CPU usage for the current day (since the start of collection)
sar -u
# Memory usage
sar -r
# Paging activity (swapping)
sar -S
# Disk activity
sar -b
# Network activity
sar -n DEV
# Display data from the previous day (saDD-1 file)
sar -u -f /var/log/sysstat/sa$(date +%d -d "1 day ago")
iostat - Focus on disks
Displays real-time statistics on disk input/output.
# Basic report
iostat
# Detailed report with more information (extended) and in MB
iostat -x -m
# Continuous report every 2 seconds
iostat -x -m 2
Look at the %util (disk utilization percentage) and await (average wait time) columns to identify bottlenecks.
mpstat - Focus on the CPU
Displays detailed statistics for each processor/core.
# Statistics for all cores (ALL)
mpstat -P ALL
# Statistics for all cores, updated every 2 seconds
mpstat -P ALL 2
- A high %user in `sar` means your applications are consuming a lot of CPU. - A high %system means the kernel is spending a lot of time in system calls. - A high %iowait is a sign that the CPU is waiting on the disks. This is often the first indicator of a storage problem. - Non-zero swap activity (
sar -S) on a system with free RAM is a sign of misconfiguration or memory pressure.
Conclusion
The Sysstat suite of tools is essential for any serious system administrator. It provides the raw data needed to objectively diagnose performance problems. Learning to read the reports from sar, iostat, and mpstat will give you a deep understanding of how your servers behave and help you make informed decisions to optimize their resources.
Comments