Monitor Network Stats with sar

The System Actvity Report or sar for short, can be used to track all kinds of system-metrics.


sar is part of the sysstat package and can probably be installed with your distributions packagemanager.

[tux@server]$ sudo dnf install sysstat

[tux@server]$ sudo apt install sysstat

Samples and Intervals

sar operates by measuring stats over a certain interval and aggregating them afterwards. Because of that we should always define the interval for every sample and how many samples we want. Otherwise we will get all values that sar has stored and will probably far more than you need.

[tux@server]$ sar <what to track> <sampling-interval> <number of samples>

Network Options

To tell sar to monitor network statistics, we need the parameter -n. Next we have to specify what to monitor: DEV: statistics from the network devices EDEV: statistics on failures (errors) from the network devices ICMP: statistics about ICMPv4 network traffic EICMP: statistics about ICMPv4 error messages ICMP6: statistics about ICMPv6 network traffic EICMP6: statistics about ICMPv6 error messages IP: statistics about IPv4 network traffic EIP: statistics about IPv4 network errors IP6: statistics about IPv6 network traffic EIP6: statistics about IPv6 network errors NFS: statistics about NFS client activity NFSD: statistics about NFS server activity SOCK: statistics on sockets in use (IPv4) SOCK6: statistics on sockets in use (IPv6) SOFT: statistics about software-based network processing TCP: statistics about TCPv4 network traffic ETCP: statistics about TCPv4 network errors UDP: statistics about UDPv4 network traffic UDP6: statistics about UDPv6 network traffic

Network Bandwidth

If you just want to see the overall network bandwidth, use DEV.

[tux@server]$ sar -n DEV <sampling-interval> <numbers of samples>

The sampling-interval will define how many seconds sar will collect data for this one measurement. The number of samples will tell sar how often to repeat this process. In the end sar will give you an average over all the specified samples as well.

For Example if we want to take 2 samples with 3 Seconds each we will do the following.

[tux@server]$ sar -n DEV 2 3
07:52:16 AM        lo      0.00      0.00      0.00      0.00      0.00      0.00      0.00      0.00
07:52:16 AM    ens192     10.00      1.50      0.59      0.15      0.00      0.00      0.00      0.00

07:52:18 AM        lo      0.50      0.50      0.05      0.05      0.00      0.00      0.00      0.00
07:52:18 AM    ens192     17.50     10.50      1.67      2.51      0.00      0.00      0.00      0.00

07:52:20 AM        lo      0.00      0.00      0.00      0.00      0.00      0.00      0.00      0.00
07:52:20 AM    ens192     19.00     43.50      1.35     12.41      0.00      0.00      0.00      0.00

Average:           lo      0.17      0.17      0.02      0.02      0.00      0.00      0.00      0.00
Average:       ens192     15.50     18.50      1.21      5.02      0.00      0.00      0.00      0.00

You can see that we get 3 samples even though we only specified 2. That is because the first one is a baseline reading to start with an empty counter.

profile picture of the author

Jannik Rehkemper

I'm an professional Linux Administrator and Hobby Programmer. My training as an IT-Professional started in 2019 and ended in 2022. Since 2023 I'm working as an Linux Administrator.