System Monitoring With sar And ksar

sar is one of the old and famous commandline utilities, which is often overlooked. It provides a wealth of information when you have kind of performance bottlenecks. By itself it only provides lengthy columns of numerical data, kind of hard to interpret. sar exists on most Linux distributions, for example Ubuntu, Debian, CentOS, Gentoo, and is also available on Solaris, AIX, and other commercial Unices.

ksar, on the other hand, is a Java based front end for sar’s numerical data. It produces friendly graphs which could be exported to .pdf

Preliminary Note + Disclaimer
you should be familiar using a shell, at least some basic knowledge is advantageous.

The following tutorial is a kind of cooking receipe using sar and ksar. It should easily be adoptable to nearly any kind of Linux or Unix, where the prerequisites are available

1. sar
sar is commandline driven. It is in a package named like sysstat (Ubuntu, Debian, CentOS, Gentoo, to name some). You should install it using your favourite package manager (apt-get, yum, synaptic, yumex, emerge, ..). Favourably sar could and should be used in conjunction with cron, so you may have a look into /etc/cron.d/sysstat or a similar named file

sar is run with the help of cron every 10 minutes, produces a kind of binary snapshot what is going on on the system, and at 23:53 a daily summary is produced. The “human friendly” daily summary and the binary database are stored in /var/log/sa (CentOS) or in /var/log/sysstat (Debian, Ubuntu). sar produces a file per day, and holds old databases for a month (default)

2. ksar
ksar is not in the repositories of the common systems
ksar comes in a .zip archive, you should unpack it using unzip to a destination you like to have it, maybe /opt or /usr/local/bin.

It is unpacked into a directory of it’s own, for instance like


Changing into this directory you should find a file named

-rwxr-xr-x 1 root root 276 2008-11-25 19:19*
changed it’s permission to be executable

/usr/local/bin/kSar-5.0.6/ &