Calculate the number of background daemons running and their aggregate resource usage.
'Enabled' (systemctl is-enabled) means a unit is configured to start automatically at boot; 'running' (systemctl is-active) means it's actually active right now — the two lists commonly diverge because of oneshot-type units (which run once and exit successfully, e.g. one-time setup tasks), condition-gated units (After=/ConditionPathExists= etc. that only start under specific circumstances), or units that failed to start. Estimating aggregate RSS across running daemons (average per-daemon footprint × running count) gives a rough baseline memory cost of 'always-on background services' separate from application workload memory, useful for right-sizing minimal-footprint systems or containers.
Estimated total daemon memory
total_rss = running_daemons × avg_rss_per_daemon
Common reasons: it's a oneshot-type unit that runs once at boot and legitimately exits (RemainAfterExit=no), it's gated by a condition that isn't currently satisfied, it depends on a socket/timer and is only activated on demand (socket or timer activation), or it crashed/failed to start and hit its restart limit — `systemctl status <unit>` shows the specific reason.
`systemctl list-unit-files --state=enabled` lists every unit file configured to start at boot, while `systemctl list-units --type=service --state=running` shows what's actually active right now — comparing the two surfaces exactly which enabled services aren't currently running.
It can help on memory-constrained systems or minimal container/VM images, but weigh it against functionality lost — disabling something like a logging daemon or security agent saves a modest amount of RAM at the cost of losing its function. Profile actual per-daemon RSS via `systemd-cgtop` or `ps` before deciding which are worth disabling.