SAR内存输出与free命令的关联及数值不符问题咨询

Hey there! Let's dig into why you might notice mismatches between sar's memory stats and what free -h shows, plus how these two tools actually connect.

First, let's clarify core differences between the two tools #

• free -h takes a real-time snapshot of your server's memory at the exact moment you run it.
• When you use sar -f /var/log/sa/sa04 -r, you're looking at historical sampled data: either individual time-point snapshots (like the 10:15:01 AM entry in your output) or an average of all samples for the period (the Average: line). Comparing an average to a real-time snapshot will almost always show discrepancies—make sure you're comparing apples to apples!

Field-by-field mapping (and where discrepancies often pop up) #

Let's match up your sar -r fields to free output, using your CentOS 7 kernel (3.10.0-1062.el7) as context:

• kbmemfree (sar) ↔ free column in free -h
• kbmemused (sar) ↔ used column in free -h (both include buffers and cached memory by default)
• kbbuffers (sar) ↔ buffers column in free -h
• kbcached (sar) ↔ cached column in free -h

Common mismatch causes for your kernel version:

1. Slab memory inclusion: In older sysstat versions (the package that provides sar), kbcached might not include Slab memory, but free's cached column does. This can lead to a noticeable gap between the two cached values.
2. Kernel/sysstat version differences: The referenced website might describe behavior from a newer kernel or sysstat release. CentOS 7 uses a relatively old kernel and sysstat package, so some field calculations might differ slightly from newer distributions.
3. Commit vs actual memory: sar includes kbcommit and %commit—these measure the total memory that's been committed (including potential swap usage), not actual used memory. free doesn't have a direct equivalent, so don't confuse these with your real RAM utilization.

How to verify and troubleshoot #

• Compare real-time samples: Run sar -r 1 1 (takes 1 sample, 1 second apart) and free -b (uses bytes to avoid unit conversion errors) at the same time. The numbers should align closely if there's no underlying issue.
• Check your sysstat version: Run sar -V—if you're on an older version, updating the sysstat package (yum update sysstat for CentOS 7) might resolve minor calculation inconsistencies.
• Focus on matching time points: When checking historical sar data, find a specific time entry (like 10:15:01 AM) and compare it to a free snapshot taken at that exact moment (if you have logs or can replicate the timing).

备注：内容来源于stack exchange，提问作者iostrym