When I sum the RSS number in the ps command for a specific user and compare it with the RSS values of the prstat command of the same user - there is a big difference.
Server details: Solaris 10 5/09 s10s_u7wos_08 SPARC
prstat output:
NPROC USERNAME SWAP RSS MEMORY TIME CPU
259 gpsvip01 14G 10G 87% 136:57:30 6.0%
PS:
When I sum the value of RSS of all the processes for user=gpsvip01, it sums with 20GB.
Note- when I compare the RSS values of PS vs lparstat on a different server (Oracle Solaris 10 8/11 s10s_u10wos_17b SPARC) the values are almost the same.
Question: This zone has 12GB of memory. Is it possible that gpsvip01 user is using memory from other zones, and how can I prove/disprove this assumption?
Things are changing all the time. If you run prstat then you run ps you get two differtent snapshots of memory. Even if you run them more or less simultaneously they will not examine the processes in perfect lockstep.
Now consider that a user is running 10 different processes which are 10 different programs. However all 10 were written in C and all 10 use the standard C library and the C I/O library. These libraries are mapped into all 10 ten processes. But they are shared libraries. Only one copy actually resides in core. That single copy is counted in the RSS of all 10 processes. Now one of the 10 suddenly wants to call, let's say, strncpy() but the code for that is not currently in core. So it page faults its way in. That increases the RSS of all 10 processes even though 9 of the 10 may currently be asleep.
We don't have that many shared libraries. I don't expect the same values. But the sum of RSS from PS is 20GB and from prstat is 10GB. On other Solaris servers that have the same code the differance is at most 1GB.