Rcapd to limit zone RSS usage - total confusion!

Question

I'm trying to use rcapd to limit an entire zone to a certain RSS limit.
i do this by setting all processes in the zone to run in within the 'system' project, with the following /etc/project file set to cap RSS at 128MB:
system:0::*::process.max-file-descriptor=(basic,4096,deny);rcap.max-rss=134217728
user.root:1::::process.max-file-descriptor=(basic,4096,deny);rcap.max-rss=134217728
noproject:2::::rcap.max-rss=134217728
default:3::::process.max-file-descriptor=(basic,4096,deny);rcap.max-rss=134217728
group.staff:10::::process.maxand-file-descriptor=(basic,4096,deny);rcap.max-rss=134217728and the follwing /etc/user_attr :
adm::::profiles=Log Management;project=system
lp::::profiles=Printer Management;project=system
root::::auths=solaris.*,solaris.grant;profiles=All;lock_after_retries=no;project
=systemThis appears to properly put everything within the zone running within a single project :
zone11# ps -e -o pid,project,comm
  PID  PROJECT COMMAND
20772   system /usr/local/apache2/bin/httpd
2121   system /usr/lib/sendmail
2107   system /usr/lib/sendmail
20798   system /usr/local/apache2/bin/httpd
2662   system zsched
26755   system /usr/local/sbin/clamd
  533   system /opt/local/pgsql/bin/postmaster
3489   system /sbin/init
27103   system /usr/lib/rcap/rcapd
26840   system /usr/bin/mimedefang
3548   system /lib/svc/bin/svc.startd
1300   system /usr/local/apache2/bin/httpd
1301   system /usr/local/bin/ruby
24109   system /usr/bin/perl
  583   system /opt/local/pgsql/bin/postmaster
20773   system /usr/local/apache2/bin/httpd
1292   system /usr/local/apache2/bin/httpd
3639   system /bin/perl
3551   system /lib/svc/bin/svc.configd
4786   system /usr/lib/utmpd
4813   system /usr/lib/saf/ttymon
4791   system /usr/lib/inet/inetd
4790   system /usr/sbin/syslogd
4751   system /usr/sbin/cron
4306   system /usr/sbin/saslauthd
4304   system /usr/sbin/saslauthd
4305   system /usr/sbin/saslauthd
4307   system /usr/sbin/saslauthd
4308   system /usr/sbin/saslauthd
4316   system /usr/lib/crypto/kcfd
2880   system /opt/local/pgsql/bin/postmaster
27361   system /bin/ksh
4815   system /usr/lib/ssh/sshd
1302   system /usr/local/apache2/bin/httpd
1303   system /usr/local/apache2/bin/httpd
24116   system /usr/bin/perl
26824   system /usr/bin/mimedefang-multiplexor
25826   system /opt/local/pgsql/bin/postmaster
  582   system /opt/local/pgsql/bin/postmaster
1316   system /usr/local/bin/ruby
17091   system /usr/local/apache2/bin/httpd
4946   system /usr/bin/perl
1305   system /usr/local/apache2/bin/httpd
24117   system /usr/bin/perl
1304   system /usr/local/apache2/bin/httpd
2879   system /usr/local/apache2/bin/httpd
  584   system /opt/local/pgsql/bin/postmaster
20763   system /usr/local/apache2/bin/httpd
8913   system /usr/bin/perl
28246   system psSo - unless I've totally misunderstood things, this should cap RSS for the entire zone to 128MB......
But - 'prstat' from the global zone shows:
   PID USERNAME  SIZE   RSS STATE  PRI NICE      TIME  CPU PROCESS/NLWP
27103 daemon    155M  135M sleep    1    0   0:13:33 0.0% rcapd/1
  1316 nobody     34M   22M sleep   59    0   0:00:27 0.0% dispatch.fcgi/1
25826 203        16M   13M sleep    1    0   0:00:01 0.0% postgres/1
  2880 203        16M   12M sleep   59    0   0:00:01 0.0% postgres/1
   533 203        15M   11M sleep   59    0   0:00:00 0.0% postgres/1
   582 203        15M   11M sleep   59    0   0:00:19 0.0% postgres/1
  1301 nobody     33M 6952K sleep   59    0   0:00:27 0.0% dispatch.fcgi/1
  3551 root     8768K 4072K sleep   59    0   0:12:36 0.0% svc.configd/22
24109 root       26M 2408K sleep   58    0   0:03:50 0.0% spamd/1
  1302 nobody     18M 2336K sleep    1    0   0:00:00 0.0% httpd/1
  3639 root       10M 2280K sleep   59    0   0:00:47 0.0% miniserv.pl/1
  4316 daemon   4292K 1912K sleep   59    0   0:03:54 0.0% kcfd/4
  1303 nobody     18M 1884K sleep    1    0   0:00:00 0.0% httpd/1
  4791 root     3280K 1608K sleep   58    0   0:00:36 0.0% inetd/4
24116 root       26M 1600K sleep   57    0   0:00:03 0.0% spamd/1
ZONEID    NPROC  SIZE   RSS MEMORY      TIME  CPU ZONE
    15       48  755M  262M   4.3%   0:40:57 0.1% zone11
Total: 48 processes, 106 lwps, load averages: 0.26, 0.30, 0.30So the zone is using 262MB of RSS, with the largest abuser being - rcapd .... ??
What am I missing here??
Oh, this is x86 S10u1 :
# uname -a
SunOS srv1 5.10 Generic_Patch_118844-30 i86pc i386 i86pc

Answer 1

If you have the RSS capped at 128MB and an application crosses that threshold, the scanner will begin working on paging until it gets below the set cap. Note that it is perfectly reasonable that this may not be a successful attempt if the app's RSS is genuinely larger than 128MB, in which case you'll be glad you have more on tap.
In the prstat output, swap is the total swap space allocated to the zone, and RSS is the resident set. In other words, the actively consumed memory. So, if I had swap of 462M and RSS of 415M, I have 47M which has been successfully paged.
-Chris