A Linux “out of memory” (OOM) message tells you that a memory boundary was exhausted and that a supervisor selected a process to terminate. It does not, by itself, prove that the selected process has a memory leak. The limit may have been the whole host, a cgroup or container, or a service policy enforced by systemd-oomd.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
Diagnose the incident in this order: confirm who killed what and when; determine whether the host or a cgroup ran out of allowance; capture per-process and mapping-level samples over time; then use Valgrind for user-space allocations or kmemleak for suspected kernel allocations. Only after that should you change code, workload size, limits, swap, capacity, or kill priority.
As an Amazon Associate I earn from qualifying purchases.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsWhat an OOM event actually proves
The kernel OOM killer runs when it cannot satisfy an allocation within the memory available to the relevant scope. With the normal vm.panic_on_oom policy, Linux kills a process rather than panicking. The documented values are:
panic_on_oom |
Policy |
|---|---|
| 0 | Use the normal OOM-killer path and terminate a candidate task. |
| 1 | Panic for a system-wide OOM; behavior for some constrained allocations can still differ by context. |
| 2 | Force a kernel panic on OOM conditions. |
For each eligible task, the kernel calculates a badness value from 0 to 1000. A value of 0 means “never kill” in the heuristic; 1000 means the task is always preferred when otherwise eligible. /proc/<pid>/oom_score_adj shifts that preference, while /proc/<pid>/oom_score shows the current calculated score. A high score is a kill preference, not evidence that the process caused the memory shortage.
#1 Best Overall
- BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
- EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
- COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
- LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
- WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.
When task dumping is enabled, the kernel log can include the selected PID, command, resident-memory figures, swap information, and oom_score_adj. Treat that record as an event report. It identifies the victim and the conditions at that instant; it does not establish a leak.
Step 1: Confirm the event, scope, and timestamp
Start with logs before changing limits or restarting services. Query the previous boot as well as the current one if the machine rebooted after the incident.
journalctl -k -b -1— read kernel messages from the previous boot; replace-1with the relevant boot number.dmesg -T— print kernel messages with human-readable timestamps when the ring buffer still contains the event.journalctl -u your-service.service— inspect the service manager’s record for the same interval.- Search for terms such as
Out of memory,oom-kill,Killed process, orsystemd-oomd.
Record the timestamp, PID, command name, parent service or container, and the memory scope that was exhausted. A kernel line naming a killed process is different from a service manager line reporting that a unit was stopped, and both differ from an application that exits after receiving an allocation failure.
Step 2: Establish the host-wide memory picture
Take a snapshot close to the event or during a reproducible reproduction. These commands show competing consumers, swap, and kernel-reported totals:
ps -eo pid,ppid,comm,%mem,rss,vsz --sort=-rss
free -h
swapon --show
cat /proc/meminfo- RSS is resident memory currently backed by RAM for a process. Shared pages can be counted in more than one process’s RSS, so summing RSS is not a precise host total.
- VSZ is the virtual address-space size. It can include reservations, unmapped ranges, shared libraries, and sparse allocations that consume little or no RAM.
free -hgives a quick host view;/proc/meminfosupplies the detailed counters needed when cache, reclaimable slab, or swap behavior matters.swapon --showconfirms whether swap exists and where it is configured. Swap can delay an OOM, but it does not repair an unbounded allocation pattern.
Save this output with the incident timestamp. A later snapshot cannot reconstruct how much memory was available when the kernel made its decision.
Rank #2
- WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
- AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
- PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
- ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
- COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed
Step 3: Inspect the candidate PID through /proc
For a suspected process, replace $PID with the recorded PID and capture all of the following:
cat /proc/$PID/status
cat /proc/$PID/oom_score
cat /proc/$PID/oom_score_adj
cat /proc/$PID/smaps_rollupThe files answer different questions:
| File | What it provides | Best use |
|---|---|---|
/proc/<pid>/status |
Convenient fields including state, thread count, virtual size, resident set, and other process counters. | Fast per-PID snapshots and correlation with the kernel log. |
/proc/<pid>/maps |
Address ranges, permissions, offsets, devices, and file names for each mapping. | Identify which libraries, files, or anonymous ranges exist. |
/proc/<pid>/smaps |
Per-mapping accounting such as RSS, private and shared pages, anonymous memory, and proportional values. | Explain which mapping is growing. |
/proc/<pid>/smaps_rollup |
An aggregate of the smaps counters for the entire process. | Low-overhead, repeatable sampling before drilling into individual mappings. |
Read smaps_rollup at fixed intervals and retain the raw samples. Use smaps when the aggregate changes and you need to attribute the change to a heap, a mapped file, a shared object, a stack, or another range. A process can have a stable RSS while its virtual address space grows, so inspect the counter that corresponds to the symptom instead of relying on one number.
Step 4: Check cgroup limits and memory pressure
A service can be killed even while the host has apparently free memory. In cgroup v2, the service or container has its own accounting and limits. Locate its cgroup (for a system service, systemctl status your-service.service is a practical starting point), then inspect these files in that directory:
cat memory.current
cat memory.max
cat memory.high
cat memory.events
cat memory.pressurememory.currentis current usage charged to the cgroup.memory.maxis the hard ceiling; a value ofmaxmeans no finite limit at that level.memory.highis a throttling boundary that applies reclaim and can make a workload stall before a hard OOM.memory.eventsrecords events such as high-limit pressure and OOM activity. Capture it before restarting the unit.memory.pressureexposes pressure-stall information (PSI), showing how much time tasks are delayed waiting for memory.
Correlate those counters with systemctl status and journalctl -u systemd-oomd. systemd-oomd monitors cgroups v2 and PSI and can terminate configured units before the kernel-space OOM path. Its documented D-Bus interface reports the affected cgroup and a reason such as memory-used or memory-pressure. The Killed() signal is present in the documented interface beginning with systemd version 252. If the host still had free pages, a cgroup limit or systemd-oomd action is a more likely explanation than a host-wide kernel OOM.
Step 5: Sample over time instead of guessing from one reading
Memory diagnosis is a time-series problem. Under a stable, repeatable workload, collect a process status and rollup at a fixed interval:
Rank #3
- Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
- Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
- Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
- ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
- Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)
while sleep 10; do
date --iso-8601=seconds
awk '/^(VmRSS|VmSize|Threads):/ {print}' /proc/$PID/status
awk '/^(Rss|Pss|Private_Clean|Private_Dirty|Shared_Clean|Shared_Dirty|Anonymous|Swap):/ {print}' /proc/$PID/smaps_rollup
echo
doneStop the sampler cleanly and keep the output with the workload description, build, configuration, and cgroup counters. Repeat identical cycles and observe what happens when the workload becomes idle.
| Observed pattern | More consistent with | Next check |
|---|---|---|
| Memory rises through identical cycles and remains high after quiescence. | A user-space leak or an intentionally retained cache. | Break down smaps and run a representative test under Memcheck. |
| A one-time step occurs during a known batch, then levels off. | Workload sizing, allocator retention, or a deliberate cache warm-up. | Repeat with a smaller batch or concurrency and compare the plateau. |
RSS is stable but a cgroup reaches memory.max. |
A limit mismatch rather than a process leak. | Inspect cgroup accounting, other processes in the group, and the limit owner. |
| Host user memory is stable while slab or kernel counters grow. | Possible kernel-space retention. | Inspect slab statistics and, if available, kmemleak. |
Strengthen a leak hypothesis only when growth repeats across equivalent runs, continues beyond the workload’s expected lifetime, and is not released during an idle period. Check open-file-descriptor count, thread count, mapping count, and application cache metrics at the same timestamps; a descriptor or thread leak can create secondary memory growth.
Step 6: Attribute growth to mappings and allocators
When smaps_rollup shows growth, inspect /proc/$PID/smaps and group ranges by type:
- Anonymous/private dirty pages usually include heap allocations, language runtimes, and private data structures.
- File-backed pages can represent mapped assets, databases, or shared libraries. Growth may be legitimate file mapping rather than leaked heap memory.
- Shared pages can be charged differently by RSS and proportional accounting; avoid treating every shared increase as a private leak.
- Stack mappings can grow with thread count or deep recursion.
Compare the same mapping names and address ranges between samples. A single mapping that grows with each cycle is more actionable than a total RSS increase with no attribution. If an allocator keeps freed pages for reuse, the process may retain RSS without losing ownership; test by running the same cycle again, reducing concurrency, or using the runtime’s documented trimming or cache controls rather than immediately labeling it a leak.
Step 7: Confirm user-space leaks with Valgrind Memcheck
Valgrind Memcheck instruments user-space allocations and records the call stacks associated with lost blocks. Use a representative workload, preferably a small deterministic test that completes in a reasonable time because instrumentation can substantially slow execution.
Rank #4
- Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
- Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
- 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
- Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
- USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC
valgrind --tool=memcheck --leak-check=full --show-leak-kinds=all ./programBuild with symbols and keep optimization settings consistent with the binary you are diagnosing when possible. At shutdown, compare reports across repeated runs:
- Definitely lost means no remaining pointer to the allocation was found and is the strongest direct leak signal.
- Indirectly lost means the block became unreachable through a definitely lost parent; fix the owning loss first.
- Still reachable means pointers still exist at exit. It can be intentional cache or runtime state and is not automatically a defect.
Inspect allocation stacks, then map the owner and lifetime of each block in application code. A clean Memcheck run does not rule out leaks in another process, a native library outside the exercised path, shared-memory usage, or kernel allocations. Conversely, a Memcheck finding matters only if the allocation is unreachable or grows under the production-like cycle; one-time initialization can legitimately remain reachable.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Step 8: Investigate suspected kernel leaks
If user processes remain stable while slab or other kernel memory grows, inspect kernel-object accounting:
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →cat /proc/slabinfo
slabtopFor deeper analysis, the kernel must be built with CONFIG_DEBUG_KMEMLEAK, and debugfs must be mounted. Then read the kmemleak interface:
cat /sys/kernel/debug/kmemleak
echo scan > /sys/kernel/debug/kmemleak
cat /sys/kernel/debug/kmemleakThe automatic scanner runs every 600 seconds by default. A manual scan gives an intermediate result, but kmemleak reports possible unreferenced objects, not proof of a defect: caches, delayed freeing, and scanner limitations can produce candidates. Correlate a report with slab growth, the kernel version and configuration, workload changes, and a reproduction that survives quiescence. Do not enable debugging on a production kernel without understanding its overhead and operational impact.
Best Value
- Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
- Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
- Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
- Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
- Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.
Remediate the cause, not just the victim selection
Fix ownership and lifetime bugs
For a confirmed user-space leak, correct the allocation owner, destructor path, reference counting, cancellation handling, or cache eviction policy. Add a regression test that runs the repeating workload and asserts that memory returns to an expected band after each cycle. Re-run Memcheck and the long-duration sampler after the code change.
Control workload size and concurrency
Cap simultaneous matches, jobs, worker threads, queued requests, or asset loads when the workload itself exceeds available memory. A step increase tied to batch size is normally addressed by bounded queues, smaller batches, or lower concurrency rather than by hiding the symptom with a larger kill threshold.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Set service and container limits deliberately
Choose MemoryMax= for a systemd unit or the equivalent container limit from measured steady-state use plus a documented burst allowance. Monitor memory.current, memory.events, and PSI at the same time. A limit that is lower than the workload’s normal peak guarantees avoidable kills; one that is far above host capacity simply moves the failure to the host.
Add capacity or swap when justified
More RAM addresses a genuine capacity deficit. Swap can provide emergency headroom and reduce abrupt kills for workloads that tolerate latency, but heavy swapping can make a game server or database unusable. Validate latency, swap activity, and reclaim behavior under peak load instead of assuming that any swap size is safe.
Treat oom_score_adj as policy
Changing oom_score_adj changes which process is sacrificed; it does not reduce memory consumption. Protect only processes whose survival is intentional, and ensure another process can be terminated without destroying the service’s recovery path. Document the policy so a future operator does not mistake it for a leak fix.
Build a repeatable OOM runbook
- Preserve kernel, service, and systemd-oomd logs before rebooting or restarting.
- Record PID, command, unit or container, cgroup path, limits, and timestamps.
- Save host snapshots from
free -h,swapon --show,/proc/meminfo, and the RSS-sorted process list. - Save per-PID
status,oom_score,oom_score_adj, andsmaps_rollup. - Capture cgroup
memory.current,memory.max,memory.high,memory.events, andmemory.pressure. - Reproduce with fixed sampling intervals and a stated workload size, concurrency, binary build, and idle period.
- Choose tooling based on scope: Memcheck for user allocations, slab and kmemleak for kernel allocations.
- After remediation, repeat the same workload and retain before-and-after curves, not just a statement that the service survived.
For recurring incidents, alert on cgroup pressure, limit events, swap activity, and sustained growth in process or mapping counters. Continuous alerting can tell you that pressure is returning; it cannot replace the event logs, trend samples, and ownership analysis needed to identify the cause.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Quick Recap
Common diagnostic mistakes
- Calling every killed process a leak: the OOM heuristic chooses a victim, which may be the largest or most killable task rather than the source of growth.
- Using VSZ as RAM usage: virtual reservations are not equivalent to resident memory.
- Summing RSS across processes: shared pages can be counted repeatedly.
- Checking only the host: a cgroup can hit its ceiling while the host still reports available memory.
- Running one sample: without repeated measurements, you cannot distinguish a leak from a legitimate warm-up or batch step.
- Trusting “still reachable” blindly: retained caches and runtime shutdown behavior can produce that category without an unowned allocation.
- Interpreting kmemleak candidates as proof: validate them against slab growth and a reproducible workload.
- Raising limits before measuring: this may postpone an outage while allowing an unbounded allocation to consume the host.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
