Monitoring

Difficulty: Intermediate

3 min read 25/07/2026

Sysstat: System Performance Monitoring

Q: What is the difference between sar and iostat or mpstat ?

sar replays history already written to disk, at the granularity of the cron collection. iostat and mpstat work in real time: you pass them an interval in seconds (iostat -x -m 2, mpstat -P ALL 2) and they display the current situation. In practice, sar is for post-mortem investigation of a past incident, iostat and mpstat for watching one unfold.

Q: How do I read back yesterday's figures, or those of a specific day?

Files in /var/log/sysstat/ are named after the day of the month, so sar -u -f /var/log/sysstat/sa15 replays CPU usage for the 15th. For yesterday without working the date out by hand: sar -u -f /var/log/sysstat/sa$(date +%d -d "1 day ago"). The file obviously only exists if collection was already running that day, which is the classic trap right after enabling it.

Detailed tutorial to install and configure sysstat to monitor the performance of a Linux system using tools such as sar, mpstat, and iostat.

Back to tutorials

Key takeaways

Sysstat is about historical analysis: top and htop only show the present moment, whereas sar lets you go back to what happened at 3 a.m. Background collection has a negligible impact on performance.
On Debian/Ubuntu, nothing is recorded until ENABLED="false" is changed to ENABLED="true" in /etc/default/sysstat, followed by sudo systemctl restart sysstat. On CentOS/RHEL, collection is usually enabled by default.
Collection runs every 10 minutes via /etc/cron.d/sysstat and writes binary files named saXX in /var/log/sysstat/, where XX is the day of the month. You read them back with the -f option of sar.
The sar views worth memorising: -u for CPU, -r for memory, -S for swap, -b for disks and -n DEV for the network.
For diagnosis, a high %iowait means the CPU is waiting on storage. Confirm it with iostat -x -m by reading %util and await, while mpstat -P ALL shows whether the load is spread out or pinned to a single core.

What is sysstat?
Sysstat is a suite of performance monitoring tools for Linux. Its best-known utilities are sar (System Activity Reporter), iostat (for disk I/O), and mpstat (for per-processor statistics). It is the go-to tool for collecting and analyzing your system's performance history.

Why use sysstat?

Historical analysis: Unlike top or htop, which only show the current state, sar lets you see what happened at a specific point in the past.
Problem diagnosis: Essential for understanding the source of a slowdown (CPU, memory, disk, network?).
Comprehensive reports: Provides detailed data on nearly every subsystem of the machine.
Lightweight: Background data collection has a negligible impact on performance.

Prerequisites

A Linux server (Ubuntu/Debian, CentOS/RHEL, etc.).
Root access or sudo privileges.

Installation and activation

Step 1: Install the package

# On Debian / Ubuntu
sudo apt-get update
sudo apt-get install -y sysstat

# On CentOS / RHEL
sudo yum install -y sysstat

Step 2: Enable data collection

For sar to be able to record historical data, you need to enable collection via cron. On Debian/Ubuntu, this is done by editing a file:

sudo nano /etc/default/sysstat

Change the line ENABLED="false" to:

ENABLED="true"

On CentOS/RHEL, the service is usually enabled by default. Restart the service so it picks up the change:

sudo systemctl restart sysstat

Collection now runs every 10 minutes via a job in /etc/cron.d/sysstat.

Using the tools

The data is stored in /var/log/sysstat/ in binary files named saXX (where XX is the day of the month).

`sar` - The main tool

sar is used to display the collected data.

# CPU usage for the current day (since the start of collection)
sar -u

# Memory usage
sar -r

# Paging activity (swapping)
sar -S

# Disk activity
sar -b

# Network activity
sar -n DEV

# Display data from the previous day (saDD-1 file)
sar -u -f /var/log/sysstat/sa$(date +%d -d "1 day ago")

`iostat` - Focus on disks

Displays real-time statistics on disk input/output.

# Basic report
iostat

# Detailed report with more information (extended) and in MB
iostat -x -m

# Continuous report every 2 seconds
iostat -x -m 2

Look at the %util (disk utilization percentage) and await (average wait time) columns to identify bottlenecks.

`mpstat` - Focus on the CPU

Displays detailed statistics for each processor/core.

# Statistics for all cores (ALL)
mpstat -P ALL

# Statistics for all cores, updated every 2 seconds
mpstat -P ALL 2

Interpreting the data
- A high %user in `sar` means your applications are consuming a lot of CPU. - A high %system means the kernel is spending a lot of time in system calls. - A high %iowait is a sign that the CPU is waiting on the disks. This is often the first indicator of a storage problem. - Non-zero swap activity (sar -S) on a system with free RAM is a sign of misconfiguration or memory pressure.

Conclusion

The Sysstat suite of tools is essential for any serious system administrator. It provides the raw data needed to objectively diagnose performance problems. Learning to read the reports from sar, iostat, and mpstat will give you a deep understanding of how your servers behave and help you make informed decisions to optimize their resources.

Written by

Morgann Riu

Cybersecurity and Linux administration expert. I share my knowledge through free tutorials and training to help system administrators and developers secure their infrastructures.

My profile LinkedIn GitHub

Frequently asked questions

Why does <code>sar -u</code> return no historical data on a freshly installed Debian?

The package is there but collection is disabled by default: you have to change ENABLED="false" to ENABLED="true" in /etc/default/sysstat, then restart the service with sudo systemctl restart sysstat. Until that is done, no saXX file is written to /var/log/sysstat/ and sar simply has nothing to display. Then allow about ten minutes for the first cron collection to run.

What is the difference between <code>sar</code> and <code>iostat</code> or <code>mpstat</code>?

sar replays history already written to disk, at the granularity of the cron collection. iostat and mpstat work in real time: you pass them an interval in seconds (iostat -x -m 2, mpstat -P ALL 2) and they display the current situation. In practice, sar is for post-mortem investigation of a past incident, iostat and mpstat for watching one unfold.

How do I read back yesterday's figures, or those of a specific day?

Files in /var/log/sysstat/ are named after the day of the month, so sar -u -f /var/log/sysstat/sa15 replays CPU usage for the 15th. For yesterday without working the date out by hand: sar -u -f /var/log/sysstat/sa$(date +%d -d "1 day ago"). The file obviously only exists if collection was already running that day, which is the classic trap right after enabling it.

Does a high <code>%iowait</code> always mean the disk is at fault?

It is the first indicator of a storage problem: the CPU is available but stuck waiting on I/O. Confirm it with iostat -x -m: a %util close to saturation together with a climbing await does point to the disk as the bottleneck. If %util stays low while %iowait is high, the wait is not coming from the local disk and you need to look elsewhere.

The server has free RAM but <code>sar -S</code> shows swap activity, is that a problem?

Yes, it is a signal worth acting on: swap activity while memory is still available points to a misconfiguration, or to a burst of memory pressure that no longer shows up in a live snapshot. Cross-check with sar -r over the same time range to find the moment available memory collapsed. It is typically an application spike or a nightly job that top will never show you.

Did you enjoy this article?

Sysstat: System Performance Monitoring

Why use sysstat?

Prerequisites

Installation and activation

Step 1: Install the package

Step 2: Enable data collection

Using the tools

sar - The main tool

iostat - Focus on disks

mpstat - Focus on the CPU

Conclusion

Morgann Riu

Frequently asked questions

Comments

Recommended for you

Logwatch : Surveillance et analyse de logs

Auditd : Surveillance et Audit sur Linux

Monitoring Linux : les métriques essentielles à surveiller en production

Nginx en production : 7 optimisations qui changent tout

In-depth article on the topic

Checklist Sécurité Linux

`sar` - The main tool

`iostat` - Focus on disks

`mpstat` - Focus on the CPU