Linux Server / Performance, Capacity & Containers
Investigate a host OOM kill using kernel evidence
A process can disappear after the kernel kills work under severe memory pressure. Preserve the victim, workload and allocation context.
Environment and inputs: Linux server baseline · Ubuntu 24.04 LTS / RHEL 9-style systems. Use the specified distribution, init system and installed tool; service names, privileges and supported options can differ.
Start with this check
Confirm the host, shell and access role. Replace sample names, paths, domains and interfaces with approved targets. These are diagnostic commands; assess policy and workload impact before making changes.
journalctl -k --since '2 hours ago' --no-pagerRead the result
With authorized access to retained kernel logs, inspect the incident window for OOM details. Absence can reflect retention or a different kill source.
Resolve and verify
Correlate the event with process memory, cgroup limits and workload concurrency. Correct the demonstrated leak or capacity shortfall and test recovery behavior.
Before changing production
Do not disable the OOM mechanism or change every process's kill priority to protect one application.