sar
also: System Activity Reporter
sar (System Activity Reporter) is a command-line tool that collects, reports, and saves system performance statistics including CPU, memory, disk I/O, and network activity over time.
sar is part of the sysstat package and runs as a background daemon to periodically sample system metrics. It stores historical data in binary format, allowing you to review performance trends retrospectively—not just in real-time.
Common usage includes sar -u for CPU statistics, sar -r for memory, sar -b for I/O, and sar -n DEV for network interfaces. For example, sar -u 1 5 reports CPU usage every second for 5 intervals.
Unlike tools like top or free that show only current state, sar can display historical data from previous days using the -f flag, making it invaluable for capacity planning and troubleshooting performance issues after they occur.