FreeBSD Accounting: Install and Configure System Activity Reporter (SAR)

Q. How do I install sar command under FreeBSD to collect, report, or save system activity information? How can I setup freebsd accounting?

A. . sar, sa1, sa2 and sadc commands are for SysV system such as Linux.

You need to install a package called bsdsar under FreeBSD. It is a system activity reporter (SAR) for FreeBSD systems. It stores or shows information on network, cpu, memory, swap, and NFS usage. Data is polled at intervals – usually every 20minutes during the day, and hourly in evening/night hours and is stored for later usage.

Install bsdsar

Type the following commands to install bsdsar:
# portsnap fetch update
# cd /usr/ports/sysutils/bsdsar
# make install clean

Configure bsdsar

Open configuration file /usr/local/etc/bsdsar.conf:
# vi /usr/local/etc/bsdsar.conf
Usually you need to configure the data gathering section. To turn ON gathering of data, put the word “on” after the type of data to gather. To turn it off, put “off” after the data type to turn that gathering off. All is on by default. For example turn off nfs data gathering, modify as follows:
nfs = off
Here is my own working sample config file:

log_directory = /var/log
max_data_file_size = 4096000
cpu = on
disk = on
memory_swap = on
net = on
nfs = off
cpu_mem_processes = on

Save and close the file.

bsdsar_gather command

bsdsar_gather is used to collect data. You should see following cronjob entry at /etc/crontab file for collecting data:

20,40   8-18    *       *       *       root    /usr/local/bin/bsdsar_gather
0       *       *       *       *       root    /usr/local/bin/bsdsar_gather

How do I view selected cumulative activity counters in the operating system?

Simply use bsdsar command. To view network interface data, use:
# bsdsar -i
Sample output:

Time       In Pkts    In Errors     In Bytes     Out Pkts   Out Errors    Out Bytes    Coll  Interface
00:00      5930140            0   8741522861      3096503            0    250130450       0    em0
01:00      5965075            0   8792550130      3114793            0    252111930       0    em0
02:00      5965075            0   8792550130      3114793            0    252111930       0    em0
03:00      5965078            0   8792550507      3114796            0    252112134       0    em0
04:00      5965184            0   8792569021      3114902            0    252121128       0    em0
05:00      6004005            0   8849450350      3135235            0    254298106       0    em0
06:00      6004005            0   8849450350      3135235            0    254298106       0    em0
07:00      6004005            0   8849450350      3135235            0    254298106       0    em0
08:00      6004019            0   8849452569      3135249            0    254299292       0    em0
08:20      6087369            0   8973393420      3178573            0    257870960       0    em0
08:40      6087369            0   8973393420      3178573            0    257870960       0    em0
09:00      6087369            0   8973393420      3178573            0    257870960       0    em0
09:20      6087369            0   8973393420      3178573            0    257870960       0    em0

Time       In Pkts    In Errors     In Bytes     Out Pkts   Out Errors    Out Bytes    Coll  Interface
00:00     87328207            0 124968895768     76277756            0   5447644061       0    em1
01:00     87683130            0 125477348559     76595358            0   5470522718       0    em1
02:00     88052370            0 126006376581     76926305            0   5494392360       0    em1
03:00     88293028            0 126350982635     77142146            0   5509979199       0    em1
04:00     88293452            0 126351062483     77142510            0   5510002594       0    em1
05:00     88293927            0 126351095937     77142922            0   5510028116       0    em1
06:00     88294276            0 126351120751     77143228            0   5510047768       0    em1
07:00     88294694            0 126351149966     77143601            0   5510071725       0    em1
08:00     88295045            0 126351176397     77143918            0   5510092600       0    em1
08:20     88295174            0 126351185599     77144026            0   5510099546       0    em1
08:40     88295291            0 126351193960     77144132            0   5510106599       0    em1
09:00     88295411            0 126351202345     77144241            0   5510113604       0    em1
09:20     88295514            0 126351209917     77144332            0   5510119530       0    em1

To view cpu usage data, enter:
# bsdsar -u
Sample output:

Time     % User  % Sys  % Nice  % Intrpt  % Idle  
00:00       1      1       0         0      98
01:00       0      0       0         0     100
02:00       0      0       0         0     100
03:00       0      0       0         0     100
04:00       3      7       0         0      89
05:00       0      1       0         0      99
06:00       0      0       0         0     100
07:00       0      0       0         0     100
08:00       1      5       0         0      93
08:20       0      0       0         0     100
08:40       0      0       0         0     100
09:00       0      0       0         0     100
09:20       0      0       0         0     100

To view top 5 cpu processes, enter:
# bsdsar -s
To view top 5 memory processes, enter:
# bsdsar -S
To get help, enter:
# bsdsar -h

sa command — print system accounting statistics

sa is another preferred tool under FreeBSD to print system accounting statistics. First, you must turn on system accounting, open /etc/rc.conf file:
# vi /etc/rc.conf
Turn on accounting by entering following code:
accounting_enable="YES"
Save and close the file. Start accounting service
# /etc/rc.d/accounting start

How do I view statistics

To list all command names, including those containing unprintable characters and those used only once, enter:
# sa -a
Sort by the average number of disk I/O operations for each user command, enter:
# sa -d
To print total number of disk I/O operations, enter:
# sa -D

Show last commands executed

Use lastcomm command to display information on previously executed commands:
# lastcomm
Above command will display information about all the commands recorded during the current accounting file’s lifetime. To print the exit time and elapsed time of each command, enter:
# lastcomm -Ee
To print user vivek’s all command, enter:
# lastcomm vivek

Further readings:

• man pages sa, accton, rc.conf,lastcomm