sysstat ist eine Sammlung von Leistungsüberwachungs-Tools für Linux, darunter sar, iostat, mpstat, pidstat und cifsiostat. Diese Tools erfassen, berichten und archivieren Systemaktivitätsdaten für Echtzeitanalyse und historische Leistungsbewertung.
Installation
Linux/Ubuntu
# Ubuntu/Debian
sudo apt install sysstat
# Enable automatic data collection
sudo systemctl enable sysstat
sudo systemctl start sysstat
# Fedora/RHEL
sudo dnf install sysstat
sudo systemctl enable --now sysstat
# Arch Linux
sudo pacman -S sysstat
# Verify installation
sar -V
Enable Data Collection
# Edit sysstat config to enable collection
sudo vi /etc/default/sysstat
# Set ENABLED="true"
# Configure collection interval (default: every 10 minutes)
# Collection is handled by /etc/cron.d/sysstat or systemd timers
# Data is stored in /var/log/sysstat/ (or /var/log/sa/)
# Manually trigger a data collection
sudo /usr/lib/sysstat/sa1 1 1
sar — System Activity Reporter
CPU Usage
# Current CPU usage (1 second interval, 5 samples)
sar -u 1 5
# CPU usage with ALL fields
sar -u ALL 1 5
# Per-CPU breakdown
sar -P ALL 1 5
# Specific CPU core
sar -P 0 1 5
# CPU usage from today's historical data
sar -u
# CPU usage from a specific day's archive
sar -u -f /var/log/sysstat/sa21
# CPU usage between specific times
sar -u -s 09:00:00 -e 17:00:00
# CPU usage from a specific date file
sar -u -f /var/log/sysstat/sa15 -s 14:00:00 -e 15:00:00
Memory Usage
# Memory utilization
sar -r 1 5
# Memory with ALL fields
sar -r ALL 1 5
# Swap usage
sar -S 1 5
# Huge pages usage
sar -H 1 5
# Historical memory data
sar -r -f /var/log/sysstat/sa21
Disk I/O
# Disk I/O activity
sar -d 1 5
# Disk I/O with device names (not dev major/minor)
sar -d -p 1 5
# Block device utilization
sar -b 1 5
# Specific device only
sar -d --dev=sda 1 5
# Historical disk data
sar -d -p -f /var/log/sysstat/sa21
Network
# Network interface statistics
sar -n DEV 1 5
# Network errors
sar -n EDEV 1 5
# TCP statistics
sar -n TCP 1 5
# TCP errors
sar -n ETCP 1 5
# Socket statistics
sar -n SOCK 1 5
# All network stats combined
sar -n ALL 1 5
# NFS client statistics
sar -n NFS 1 5
# NFS server statistics
sar -n NFSD 1 5
# IP-level statistics
sar -n IP 1 5
# ICMP statistics
sar -n ICMP 1 5
Other Metrics
# Context switches and interrupts
sar -w 1 5
# Run queue and load average
sar -q 1 5
# Process creation rate
sar -c 1 5
# Paging statistics
sar -B 1 5
# I/O transfer rates
sar -b 1 5
# File systems utilization
sar -F 1 5
# TTY device activity
sar -y 1 5
# Power management
sar -m CPU 1 5
iostat — I/O Statistics
# Basic I/O stats
iostat
# Extended statistics with human-readable units
iostat -xh 1 5
# Extended statistics for all devices
iostat -x 1 5
# Show only specific device
iostat -x sda 1 5
# Include NFS mount statistics
iostat -n
# Show megabytes instead of kilobytes
iostat -m 1 5
# Show partition statistics
iostat -p sda 1 5
# Continuous monitoring every 2 seconds
iostat -x 2
# JSON output
iostat -x -o JSON 1 5
# Omit first (since boot) report
iostat -x -y 1 5
Key iostat Columns
# r/s — Read requests per second
# w/s — Write requests per second
# rMB/s — Megabytes read per second
# wMB/s — Megabytes written per second
# rrqm/s — Read requests merged per second
# wrqm/s — Write requests merged per second
# r_await — Average read request latency (ms)
# w_await — Average write request latency (ms)
# aqu-sz — Average queue size
# rareq-sz — Average read request size (KB)
# wareq-sz — Average write request size (KB)
# %util — Percentage of time device was busy
mpstat — Multiprocessor Statistics
# All CPUs summary
mpstat 1 5
# Per-CPU breakdown
mpstat -P ALL 1 5
# Specific CPU cores
mpstat -P 0,1,2,3 1 5
# Include interrupt statistics
mpstat -I ALL 1 5
# Show only specific interrupt types
mpstat -I CPU 1 5
mpstat -I SCPU 1 5
mpstat -I SUM 1 5
# JSON output
mpstat -P ALL -o JSON 1 5
# Node-level stats (NUMA)
mpstat -N ALL 1 5
pidstat — Process Statistics
# CPU usage per process
pidstat 1 5
# Memory usage per process
pidstat -r 1 5
# Disk I/O per process
pidstat -d 1 5
# Context switches per process
pidstat -w 1 5
# Threads (show individual threads)
pidstat -t 1 5
# Specific PID
pidstat -p 1234 1 5
# All stats for a specific process
pidstat -u -r -d -w -p 1234 1 5
# Filter by process name
pidstat -C "nginx" 1 5
# Show child process statistics
pidstat -l 1 5
# Stack usage per process
pidstat -s 1 5
# Combined CPU + Memory + I/O for a process
pidstat -urd -p 1234 1 5
cifsiostat — CIFS I/O Statistics
# CIFS filesystem I/O stats
cifsiostat 1 5
# Show in megabytes
cifsiostat -m 1 5
# Include timestamps
cifsiostat -t 1 5
# Skip first (since-boot) report
cifsiostat -y 1 5
Data Collection (sadc/sa1/sa2)
# sadc — System Activity Data Collector (backend)
# Typically called by cron or systemd timers
# Manual data collection (1 sample per second, 10 samples)
sudo /usr/lib/sysstat/sadc 1 10 /var/log/sysstat/sa$(date +%d)
# sa1 — Wrapper for sadc, used in cron
# Collects 1 sample:
sudo /usr/lib/sysstat/sa1 1 1
# sa2 — Generate daily summary report
# Creates sar files from binary data:
sudo /usr/lib/sysstat/sa2 -A
# Typical cron entries (/etc/cron.d/sysstat):
# Collect data every 10 minutes
# */10 * * * * root /usr/lib/sysstat/sa1 1 1
# Generate daily summary at 23:53
# 53 23 * * * root /usr/lib/sysstat/sa2 -A
Historical Analysis
# List available data files
ls -la /var/log/sysstat/
# Read data from a specific day (e.g., the 15th)
sar -u -f /var/log/sysstat/sa15
# Read data for a specific time window
sar -u -f /var/log/sysstat/sa15 -s 08:00:00 -e 12:00:00
# Export historical data as CSV
sadf -d /var/log/sysstat/sa15 -- -u > cpu_history.csv
# Export as JSON
sadf -j /var/log/sysstat/sa15 -- -u > cpu_history.json
# Export as SVG graph
sadf -g /var/log/sysstat/sa15 -- -u > cpu_graph.svg
# Compare data across days
for day in 15 16 17 18 19; do
echo "=== Day $day ==="
sar -u -f /var/log/sysstat/sa$day | tail -1
done
Kurzreferenz
| Tool | Purpose |
|---|
sar | System activity reporter (CPU, memory, disk, network) |
iostat | Disk I/O statistics |
mpstat | Per-CPU statistics |
pidstat | Per-process statistics |
cifsiostat | CIFS filesystem I/O |
sadc | System activity data collector (backend) |
sa1 | Cron wrapper for sadc |
sa2 | Daily report generator |
sadf | Data format converter (CSV, JSON, SVG) |
| sar Flag | Metric |
|---|
-u | CPU utilization |
-r | Memory utilization |
-S | Swap utilization |
-d | Disk I/O |
-n DEV | Network interfaces |
-n TCP | TCP statistics |
-w | Context switches |
-q | Run queue / load average |
-B | Paging statistics |
-b | I/O transfer rates |
-F | Filesystem utilization |
