First you could avoid the redundant pipe to grep if you put
e.g.
IDLE=`ssh user@hostname sar -u 1 5|awk '$1~/verage/{print$5}'`
But that's only cosmetic.
However, there's a subtle difference if you quote the pipe or don't, as you have done.
e.g.
... sar -u 1 5 \| awk ...
In the first case (i.e. quoted pipe) the parsing is done on the remote host,
while in the latter awk is called on the local host.
Apropos quotes,
you also may have a quoting issue, especially with awk's execution block.
Sometimes some weird quoting is necessary.
In such cases I usually play at the shell to see how tokens get expanded until I fixed any quoting issues.
What return code is reported in /var/adm/cron/log for your job?
Does the cronjob's user receive a mail of stdout and stderr on the local host?
How does your local user (i.e. the uid the cronjob runs under) authenticate with the remote host?
(e.g. Rhosts vs. RSAPubKey)
Maybe extra reference to the right keys is necessary (viz. ssh -i ...)?
Maybe split the job into single tasks for debugging.
E.g. first run the ssh sar command as cron or at job to see if the remote command gets executed and its output is caught.
Madness, thy name is system administration
