SYSTEM Cited by 1 source

sysstat package¶

What it is¶

sysstat is a Linux distribution package that bundles several long-standing performance-observability CLIs that share a common lineage and a collector daemon for historical data. It is the single most important optional package for production Linux observability.

Tools bundled¶

sar — System Activity Reporter, live + historical counters.
iostat — per-block-device I/O statistics.
mpstat — per-CPU breakdown.
pidstat — per-process stats with rolling output.
sadc — System Activity Data Collector daemon, runs under cron (typically every 10 minutes), writes compact binary to /var/log/sa/saNN for sar archive mode.
sadf — formats sadc output for XML / JSON / CSV export.
tapestat — tape-drive statistics (rarely relevant).
cifsiostat — SMB/CIFS filesystem I/O.

Why it matters on the wiki¶

Netflix's [[patterns/sixty-second-performance-checklist|60-second performance checklist]] uses four of these tools (iostat, mpstat, pidstat, sar) out of the ten commands it prescribes. Without sysstat installed, half the checklist doesn't work.

The post's explicit call-out:

Some of these commands require the sysstat package installed.

Operationally: include sysstat in your base AMI / container image. If you can't install it post-hoc on a sick host, you've lost half your first-response tooling.

Install¶

Debian / Ubuntu: apt install sysstat
RHEL / CentOS / Fedora / Amazon Linux: yum install sysstat or dnf install sysstat
Alpine / minimal containers: explicit install required (not in busybox).

On install, sadc is typically enabled via cron — this starts the historical counter collection immediately, so you have sar archive data from the moment the package goes in.

Container caveat¶

In minimal / distroless container images, the sysstat tools are often absent. For container-internal triage, either:

Install sysstat into the image.
Exec into the container and use the host-level sar from the node.
Rely on cgroup / Kubernetes-level observability (cadvisor / kubectl top / tracing via eBPF on the host) — which is the common production pattern at Netflix / Titus scale where Atlas / runq-monitor do the heavy lifting per- cgroup.

Seen in¶

sources/2025-07-29-netflix-linux-performance-analysis-in-60-seconds — foundational reference. The 60-second checklist has an explicit install-prerequisite on sysstat.