为什么当 top 和 htop 显示较少时 systemctl 显示高内存使用率？

Question

我正在运行 apache2.4 Web 服务器，并注意到当我运行systemctl status apache2或运行时service apache2 status，它说它使用的是 4.2GiB 的 RAM，这对于我拥有的 RAM 量来说不是问题，但我很困惑，因为top并且htop两者都显示仅使用了 500MiB 的 RAM，更不用说systemctl单独使用 apache2 的报告了。为什么会这样，哪个是正确的？

操作系统信息，如果需要：

OS: Kali GNU/Linux Rolling x86_64
Kernel: 4.19.0-kali3-amd64

Answer 1

tl;dr 的故事是，systemctl更彻底地考虑进程正在使用的内存，并报告整个服务的总内存使用情况，同时对top单个进程使用的内存进行更宽松的计算。apache2对于运行多个进程的服务，systemctl预计会显示比top.

Memory management in *nix is extremely complex because RAM is the limiting resource for most operations, so a lot of work has gone into making the most use of it. As such, there are different categories of memory or memory usage. I was going to list them all, but it gets kind of insane pretty quickly.

I can list some of the major categories, though. The number one distinction is RAM versus Disk. "Memory" just means a place to store data. In a lightly loaded system, all data a program needs, including the program code itself, is in RAM. As more programs want access to more data, "memory" expands to include data stored on disk. Moving "memory" between RAM and Disk is highly optimized (and complex), but since the kernel can do it, it does it in a lot of ways.

So, here is a simplified, incomplete list of categories of memory usage

• What we all thing of as memory usage: data stored in RAM that exists nowhere else.
• The majority of memory usage: data stored in RAM for use by the CPU but which actually just a copy of something stored on Disk, for which the Disk is the authority of what the data should be. For example, the operating system code.
• Data that a program stored in RAM but was not using, so the kernel wrote it to disk temporarily to free up RAM for someone who needed it right now. This is called "Swap" because memory is swapped between RAM and Disk and back.

On top of those categories, we also have:

• Shared memory, which is data multiple processes use at the same time. If you run 2 copies of the same program, the program code does not need to be duplicated, it can be stored in RAM once and the 2 processes can share it.
• Reserved memory. The program can ask the kernel for some memory to use to store data, but until it actually starts using it, it is merely reserved and does not take up any space at all (outside of the kernel memory management data structures).
• Virtual memory. This is really just the allocation of memory addresses to the program, making a convenient abstraction for a lot of things. It is often huge (my laptop is currently using over 5,000 GiB of Virtual Memory) and its size/usage is of little consequence.

So when you ask "how much memory is this program using?" there is no one answer. There really is not any good answer to such a vague question. (See this article for 6 different definitions of the question along with some discussion about why they are hard to answer.) So different programs give you different answers, often with labels attached.

Programs like top try to answer the question with something like "how much RAM would be freed up if I quit this program". The Linux top man page provides a lot of detail about how it categorized memory and what it displays.

On the other hand systemctl tries to account for all the memory a service is using, both in RAM and Swap and to some extent shared and file backed, in order to be able to automate limits on resource usage and go as far as killing a program if it uses too much memory. It uses cgroups to provide much more extensive accounting for the memory a process uses, and that is described in great detail in section 2.2 "Accounting" of this article.

So even if the service is only running one process, because systemctl includes in the total memory usage of a process any shared pages it loaded first (before any other process), any Swap it is using, any memory cache (such as file system or network buffers) it is using, and probably some other stuff, it can report a higher memory usage than top. When a service is running more than once process, then obviously you would expect memory usage to go up even further.