sar

Collect and report system activity statistics over time.

low risk

interactive breakdown — edit the command and press Explain
$ 
What it does

sar (System Activity Reporter) collects and reports CPU, memory, network, and disk statistics. Unlike vmstat/iostat which show current state, sar records historical data (when sadc daemon runs) enabling you to analyze what happened during an incident hours ago.

Common flags
FlagMeaning
-u --cpuCPU utilization
-r --memoryMemory statistics
-n DEVNetwork interface statistics
-b --ioI/O statistics
-f --fileRead from a saved data file
Examples
sar -u 1 5CPU usage, every 1 second, 5 samples · explain & risk-check →
sar -r 1 5Memory stats every second · explain & risk-check →
sar -n DEV 1 3Network traffic per interface · explain & risk-check →
sar -u -f /var/log/sysstat/sa01Review CPU history from a saved report · explain & risk-check →
Pro tip

Enable sysstat's cron job (`/etc/cron.d/sysstat`) so sar continuously records history. After an incident, use `sar -u -f /var/log/sysstat/saNN` to replay what CPU/memory did during the event.

Related
vmstat iostat dmesg
Open the full explainer →More in System & Processes

Reference text is hand-written and may be incomplete — check man sar for your version. Test destructive commands on a non-production system first.