sar
Reading the systemPackage: sysstat
Reads back the load history sysstat collects every ten minutes: CPU, memory, disk, network, by time slot. It answers "what was the machine doing at 3 a.m." when nobody was watching.
What its options do in the lessons
From the same glossary the lessons render under their commands, so the two cannot disagree.
sar -r- Reports memory usage — free, used, cache — reading by reading across the day. Memory that is *used* and climbs without falling back is a leak; a growing cache is not.
sar -q- Reports load average and run-queue pressure statistics.
sar -d- Reports activity per block device: transfers, throughput, wait time. Where a saturated disk that slows everything else shows itself.
sar -n- Reports network statistics; followed by the keyword
DEV, traffic per interface (packets and rate). sar -f- Reads an older file from
/var/log/sysstatinstead of today’s (-f …/sa01for the first of the month). The option that makes a trend readable: two dates rather than one instant.