Skip to content

SYSTEM Cited by 1 source

sysstat package

What it is

sysstat is a Linux distribution package that bundles several long-standing performance-observability CLIs that share a common lineage and a collector daemon for historical data. It is the single most important optional package for production Linux observability.

Tools bundled

  • sar — System Activity Reporter, live + historical counters.
  • iostat — per-block-device I/O statistics.
  • mpstat — per-CPU breakdown.
  • pidstat — per-process stats with rolling output.
  • sadc — System Activity Data Collector daemon, runs under cron (typically every 10 minutes), writes compact binary to /var/log/sa/saNN for sar archive mode.
  • sadf — formats sadc output for XML / JSON / CSV export.
  • tapestat — tape-drive statistics (rarely relevant).
  • cifsiostat — SMB/CIFS filesystem I/O.

Why it matters on the wiki

Netflix's 60-second performance checklist uses four of these tools (iostat, mpstat, pidstat, sar) out of the ten commands it prescribes. Without sysstat installed, half the checklist doesn't work.

The post's explicit call-out:

Some of these commands require the sysstat package installed.

Operationally: include sysstat in your base AMI / container image. If you can't install it post-hoc on a sick host, you've lost half your first-response tooling.

Install

  • Debian / Ubuntu: apt install sysstat
  • RHEL / CentOS / Fedora / Amazon Linux: yum install sysstat or dnf install sysstat
  • Alpine / minimal containers: explicit install required (not in busybox).

On install, sadc is typically enabled via cron — this starts the historical counter collection immediately, so you have sar archive data from the moment the package goes in.

Container caveat

In minimal / distroless container images, the sysstat tools are often absent. For container-internal triage, either:

  • Install sysstat into the image.
  • Exec into the container and use the host-level sar from the node.
  • Rely on cgroup / Kubernetes-level observability (cadvisor / kubectl top / tracing via eBPF on the host) — which is the common production pattern at Netflix / Titus scale where Atlas / runq-monitor do the heavy lifting per- cgroup.

Seen in

Last updated · 766 distilled / 2,225 read