SAR (System Activity Reporter) is part of the sysstat package and provides historical performance data — CPU, memory, disk I/O, network, and more — sampled at regular intervals. It’s invaluable for diagnosing past performance problems that are no longer actively occurring.

Installation

# AlmaLinux / Rocky Linux / CentOS
dnf install sysstat -y

# Debian / Ubuntu
apt install sysstat -y

# Enable the sysstat service (starts collecting data every 10 minutes)
systemctl enable --now sysstat

# Verify it's active
systemctl status sysstat

Configure Data Collection Interval

# Edit the cron schedule (default: every 10 minutes)
vi /etc/cron.d/sysstat

# Default entry:
# */10 * * * * root /usr/lib64/sa/sa1 1 1
# Change to every 2 minutes for higher resolution:
# */2 * * * * root /usr/lib64/sa/sa1 1 1

Common sar Commands

# CPU usage (today's data)
sar -u

# CPU usage for a specific past date (data stored in /var/log/sa/)
sar -u -f /var/log/sa/sa$(date -d "yesterday" +%d)

# Memory usage
sar -r

# Disk I/O
sar -d -p

# Network I/O
sar -n DEV

# Load average
sar -q

# All stats for the last hour
sar -A 1 1

Identify Performance Issues

# Find the hour with highest CPU usage yesterday
sar -u -f /var/log/sa/sa$(date -d "yesterday" +%d) | sort -k3 -rn | head -5

# Check memory usage around a specific time
sar -r -f /var/log/sa/sa$(date +%d) -s 14:00:00 -e 16:00:00

Generate an HTML Report

# Create HTML report for today
sar -A | sadf -g > /tmp/sar_report.html
# Open in browser for visual graphs