Solaris Performance Monitoring & Tuning - iostat , vmstat & netstat

Introduction to iostat , vmstat and netstat 

This document is primarily written with reference to solaris performance monitoring and tuning but these tools are available in other unix variants also with slight syntax difference.

 iostat , vmstat and netstat are three most commonly used tools  for performance monitoring . These comes built in with the operating system and are easy to use .iostat stands for input output statistics and reports statistics for i/o devices such as disk drives . vmstat  gives  the statistics for virtual Memory and netstat gives the network statstics .

Following paragraphs describes these tools and their usage for performance monitoring  and  if you need more information there are some very good solaris performance monitoring books available at www.besttechbooks.com.

Table of content :

1. Iostat

 2. vmstat

 3. netstat

4. Next Steps

Input Output statistics (  iostat )

 iostat   reports terminal and disk  I/O  activity and  CPU utilization.  The first line of output is for the  time period  since boot  &  each subsequent line is for  the  prior  interval . Kernel maintains  a number of counters to keep track of  the  values.

iostat's activity class options default  to  tdc  (terminal,  disk, and CPU). If any other option/s are specified,  this  default is completely overridden i.e.  iostat -d will report only statistics about the disks.

syntax:

Basic synctax is iostat  <options>   interval  count

option - let you specify the device for which information is needed like disk , cpu or terminal. (-d , -c , -t  or -tdc ) .  x options gives the extended statistics .

interval -  is time period in seconds between two samples . iostat  4  will give data at each 4 seconds interval.

count  - is the  number of times the data is needed .  iostat 4 5   will give data at 4 seconds interval   5 times

 

Example

$ iostat -xtc 5 2
                          extended disk statistics       tty         cpu
     disk r/s  w/s Kr/s Kw/s wait actv svc_t  %w  %b  tin tout us sy wt id
     sd0   2.6 3.0 20.7 22.7 0.1  0.2  59.2   6   19   0   84  3  85 11 0
     sd1   4.2 1.0 33.5  8.0 0.0  0.2  47.2   2   23
     sd2   0.0 0.0  0.0  0.0 0.0  0.0   0.0   0    0
     sd3  10.2 1.6 51.4 12.8 0.1  0.3  31.2   3   31
 

     The fields have the following meanings:

      disk    name of the disk
      r/s     reads per second
      w/s     writes per second
      Kr/s    kilobytes read per second
      Kw/s    kilobytes written per second
      wait    average number of transactions waiting for service (Q length)
actv    average number of transactions  actively
being serviced (removed  from  the
queue but not yet
              completed)
      %w      percent of time there are transactions  waiting
              for service (queue non-empty)
      %b      percent of time the disk is busy  (transactions
                  in progress)

Results and Solutions:

The values to look from the iostat output  are:

  • Reads/writes  per second (r/s , w/s)
  • Percentage busy (%b)
  • Service time (svc_t)

If a disk shows consistently high reads/writes along with , the percentage busy (%b) of the disks is greater than 5 percent, and the average service time  (svc_t) is greater than 30 milliseconds, then  one of the following action needs to be taken

1.)Tune the application to use disk i/o more efficiently  by modifying the disk queries and using available cache facilities of application servers .

2.) Spread the file system of the disk on to two or more disk  using disk striping feature of volume manager /disksuite  etc.

3.) Increase the system parameter values for  inode cache  , ufs_ninode ,  which is  Number of inodes to be held in memory. Inodes are cached globally (for UFS), not on a per-file system basis 

4.) Move the file system to another faster disk /controller  or replace existing disk/controller to a faster     one.

Virtual Memory Statistics ( vmstat )

vmstat -  vmstat reports virtual memory statistics of   process, virtual memory, disk, trap, and CPU activity.

Onmulticpusystems,vmstataveragesthenumberofCPUsintotheoutput.Forper-processstatistics.Withoutoptions,vmstatdisplaysaone-linesummaryofthevirtualmemoryactivitysincethesystemwasbooted.

 syntax:

Basic synctax is vmstat  <options>   interval  count

option - let you specify the type of information needed such as paging  -p , cache   -c ,.interrupt -i  etc.

if no option is specified  information about   process , memory , paging , disk ,interrupts & cpu  is displayed  .

interval  - is time period in seconds between two samples . vmstat   4  will give data at each 4 seconds interval.

count  - is the number of times the data is needed . vmstat 4   5   will give data at 4 seconds interval   5             times.
Example
The following command displays a summary of what the  system
     is doing every five seconds.

     example% vmstat 5
procs  memory          page             disk      faults        cpu
     r b w swap  free re mf pi p fr de sr s0 s1 s2 s3  in  sy  cs us sy id
     0 0 0 11456 4120 1  41 19 1  3  0  2  0  4  0  0  48 112 130  4 14 82
     0 0 1 10132 4280 0   4 44 0  0  0  0  0 23  0  0 211 230 144  3 35 62
     0 0 1 10132 4616 0   0 20 0  0  0  0  0 19  0  0 150 172 146  3 33 64
     0 0 1 10132 5292 0   0  9 0  0  0  0  0 21  0  0 165 105 130  1 21 78
 The fields of vmstat's display are

procs

rinrunqueue

bblockedforresourcesI/O,pagingetc.

wswapped

memory(inKbytes)

swap-amountofswapspacecurrentlyavailable

free-sizeofthefreelist

page(inunitspersecond).

repagereclaims-see-Soptionforhowthisfieldismodified.

mfminorfaults-see-Soptionforhowthisfieldismodified.

pikilobytespagedin

pokilobytespagedout

frkilobytesfreed

deanticipatedshort-termmemoryshortfall(Kbytes)

srpagesscannedbyclockalgorithm

disk(operationspersecond)

Thereareslotsforuptofourdisks,labeledwithasingleletterandnumber.Theletterindicatesthetypeofdisk(s=SCSI,i=IPI,etc).Thenumberisthelogicalunitnumber.

faults

in(nonclock)deviceinterrupts

sysystemcalls

csCPUcontextswitches

cpu-breakdownofpercentageusageofCPUtime.Onmultiprocessorsthisisanaverageacrossallprocessors.

ususertime

sysystemtime

ididletime

 

Results and Solutions:

A.   CPU issues:

Following columns has to be watched to determine if there is any cpu issue

  1. Processes in the run queue (procs r)
  2. User time (cpu us)
  3. System time (cpu sy)
  4. Idle time (cpu id)
procs      cpu
     r b w    us sy  id
     0 0 0    4  14  82
     0 0 1    3  35  62
     0 0 1    3  33  64
     0 0 1    1  21  78
Problem symptoms:1.) If the number of processes in run queue (procs r) are consistently greater than the number of CPUs on the system it will slow down system as there are more processes then available CPUs .2.) if  this number is more than four times the number of available CPUs in the system then system is facing shortage of cpu power and will greatly slow down the processess on the system.3.) If  the idle time (cpu id) is consistently 0 and if the system time (cpu sy) is double the user time (cpu us)  system is facing shortage of CPU resources. Resolution :Resolution to these kind of issues involves tuning of application procedures  to make efficient use of cpu  and as a last resort increasing the cpu power or adding more cpu to the system.    B.   Memory Issues:Memory bottlenecks are determined by the scan rate (sr) . The scan rate is the pages scanned by the clock algorithm per second. If the scan rate (sr) is continuously over 200 pages per second then there is a memory shortage. Resolution :1. Tune the applications & servers to make  efficient use of memory and cache.2. Increase system memory .3. Implement priority paging in s in pre solaris 8 versions by adding line "set priority paging=1" in    /etc/system. Remove this line if upgrading from Solaris 7 to 8 & retaining old /etc/system file.

Network Statistics (netstat)

netstat displays the  contents  of  various  network-related  data structures in  depending on the options selected.

Syntax :

netstat  <option/s>

multiple options can be given at one time.

Options

 -a - displays the state of all sockets.

-r-showsthesystemroutingtables

-i-givesstatisticsonaper-interfacebasis.

-m-displaysinformationfromthenetworkmemorybuffers.OnSolaris,thisshowsstatistics

forSTREAMS

-p[proto]-retrievesstatisticsforthespecifiedprotocol

-s-showsper-protocolstatistics.(someimplementationsallow-sstoremovefiledswithavalueof0(zero)fromthedisplay.)

-D-displaythestatusofDHCPconfiguredinterfaces.

-n do not lookup hostnames, display only IP addresses.-d (with -i) displays dropped packets per interface.-I [interface] retrieve information about only the specified interface.-v be verbose

interval  -   number for continuous display of statictics.

Example :

$netstat -rn

RoutingTable:IPv4

DestinationGatewayFlagsRefUseInterface

-----------------------------------------------------------------

192.168.1.0192.168.1.11U11444le0

224.0.0.0192.168.1.11U10le0

default192.168.1.1UG168276

127.0.0.1             127.0.0.1               UH       1  10497     lo0

This shows the output on a Solaris machine who's IP address is 192.168.1.11 with a default router at 192.168.1.1

Results and Solutions:

A.) Network availability

The command as above is mostly useful in troubleshooting network accessibility issues . When  outside network is not accessible from a machine check the following

1. if the default router ip  address is correct

2.  you can ping it from your machine.

3. If router address is incorrect  it can be changed  with route add  commnad . See man route  for more info .

route command examples:$route add default <hostname>$route add 192.0.2.32  <gateway_name>

If the router address is correct but still you can't ping it  there may be some  network cable /hub/switch problem  and you have to try and eliminate the faulty component .

B.) Network Response

netstat -i

NameMtuNet/DestAddressIpktsIerrsOpktsOerrsCollisQueue
lo08232loopbacklocalhost77814077814000
hme01500server1server1106585663483251102792570

This option is used to diagnose the network problems when  the connectivity is there but  it is slow in response .

Values to look at:

  • Collisions (Collis)
  • Output packets (Opkts)
  • Input errors (Ierrs)
  • Input packets (Ipkts)

The above values will give information to workout

i.  Network collision rate as follows :

Network collision rate = Output collision counts / Output packets

 Network-wide collision rate greater than 10 percent  will indicate

  •  Overloaded network,
  •  Poorly configured network,
  •  Hardware problems. 

ii.  Input packet error rate as follows :

 Input Packet Error Rate = Ierrs / Ipkts.

If the input error rate is high (over 0.25 percent), the host is dropping packets. Hub/switch cables etc needs to be checked for potential problems.

C.  Network socket &  TCP Cconnection state
Netstat gives important   information about network socket and tcp state . This is very useful in
finding out the open , closed and  waiting network tcp connection .
Network states returned by  netstat are following :
     CLOSED               ----  Closed.  The socket  is  not  being used.

LISTEN----Listeningforincomingconnections.

SYN_SENT----Activelytryingtoestablishconnection.

SYN_RECEIVED----Initialsynchronizationoftheconnectionunderway.

ESTABLISHED----Connectionhasbeenestablished.

CLOSE_WAIT----Remoteshutdown;waitingforthesockettoclose.

FIN_WAIT_1----Socketclosed;shuttingdownconnection.

CLOSING----Closed,thenremoteshutdown;awaitingacknowledgement.

LAST_ACK----Remoteshutdown,thenclosed;awaitingacknowledgement.

FIN_WAIT_2----Socketclosed;waitingforshutdownfromremote.

TIME_WAIT----Waitaftercloseforremoteshutdownretransmission.

Example: #netstat -a
Local AddressRemote AddressSwind  Send-QRwindRecv-QState 
*.**.*00245760IDLE
*.22*.*00245760LISTEN
*.22*.*00245760LISTEN
*.**.*00245760IDLE
*.32771*.*00245760LISTEN
*.4045*.*00245760LISTEN
*.25*.*00245760LISTEN
*.5987*.*00245760LISTEN
*.898*.*00245760LISTEN
*.32772*.*00245760LISTEN
*.32775padding-right: 1px; padding-left: 1px; font-weight: 400; font-size: 10pt; vertical-align: bottom; color: windowtext; padding-top: 1px;