Stop treating an out-of-memory (OOM) message as a generic Linux fault. First determine whether the kernel OOM killer or systemd-oomd acted, then identify the process or cgroup that exhausted memory. Recover by stopping the noncritical workload, add swap only as emergency headroom, reduce the workload’s peak demand, and apply measured systemd or container limits. Resize the VPS when tested demand still exceeds physical RAM plus swap you can tolerate without unacceptable latency.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
What an out-of-memory error means
Linux can fail a memory allocation when available RAM, reclaimable cache and configured swap cannot satisfy demand. The kernel then invokes its OOM killer. The usual log contains wording such as Out of memory: Kill process or Killed process 1234 (name). With the normal vm.panic_on_oom=0 setting, the kernel kills a process and normally keeps the VPS running. Values 1 and 2 request panic behavior instead; those settings are intended for specialized failover arrangements, not an ordinary VPS.
As an Amazon Associate I earn from qualifying purchases.
A second mechanism can act before the kernel: systemd-oomd is a userspace OOM killer. It watches cgroup-v2 memory pressure and pressure-stall information (PSI), then can terminate eligible systemd units before the kernel reaches an unrecoverable allocation failure. Its documentation recommends having swap because swap gives the daemon time to observe and react to pressure. With no swap, pressure can become abrupt enough that the daemon does not respond in time.
The victim named in an OOM record is not always the process that caused the overall problem. It is the process selected when the system needed to free memory. Treat the PID, command name and cgroup as leads for investigation, not proof that the victim contains a bug.
#1 Best Overall
- A-Tech RAM Memory compatible for select DDR4 Servers & Workstation systems only; (*WILL NOT WORK with Desktop Computers, Laptop Computers, or PCs of any kind*)
- 128GB RAM Kit (8 x 16GB Modules); DDR4 DIMM 288 Pin; Speeds up to 2133MHz PC4-17000 (PC4-2133P)
- ECC Registered RDIMM; 2Rx4 - Dual Rank x4; JEDEC DDR4 standard 1.2V
- Improves system performance, workload capacity, and reduces bottlenecks by increasing memory (RAM) resources
- Note: This memory is ECC Registered and cannot be mixed with different ECC types such as ECC Unbuffered, ECC Load Reduced, or Non-ECC Unbuffered; (Memory compatibility can vary among different system models and their installed components; please verify compatibility and follow memory channel guidelines to ensure maximum performance)
Diagnose before changing settings
Changing swappiness, overcommit or panic behavior before preserving evidence can hide the cause and make the next failure harder to explain. Work through these checks in order.
1. Preserve current and previous-boot evidence
Read kernel messages for the current boot and the boot before it:
Recommended Free Tools
journalctl -k -b
a journalctl -k -b -1Search the output for oom, out of memory, killed process, memory cgroup and systemd-oomd. The first command is the authoritative starting point for the current boot; the second is essential after a reboot because it preserves the failure that forced the restart. On systems where the kernel ring buffer is available, also run:
dmesg -TIf persistent journaling is not enabled, configure it before the next incident so a reboot does not erase the evidence. Keep kernel and service logs on storage with enough free space.
2. Measure capacity, swap and disk space
free -h
swapon --show
cat /proc/meminfo
df -hfree -h shows total, used, available and swap memory in human-readable units. swapon --show tells you whether swap exists and whether it is already full. /proc/meminfo exposes details such as committed memory, reclaimable cache and swap totals. df -h matters because a full filesystem can prevent journal writes and can leave no room for a swap file.
Do not confuse Linux page cache with an application leak. Cache is normally reclaimable; the available figure is more useful than the raw “used” column for judging immediate headroom. A VPS that repeatedly reaches zero available memory, exhausts swap and shows rising latency has a capacity problem even if a brief snapshot looks healthy.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstall3. Identify the largest consumers
ps -eo pid,ppid,comm,%mem,rss --sort=-rss | head -n 20RSS is resident memory in use by each process. Confirm the result with top or htop, then record whether the largest consumers are a database, language runtime, web workers, a container, a build job or a kernel-related allocation. Capture several samples during normal traffic and during the failure window; one snapshot can miss a short-lived compiler, import process or scheduled task.
4. Check the service and cgroup that owned the process
For a systemd unit, substitute its actual name for <unit>:
systemctl status <unit>
journalctl -u <unit>
systemctl show <unit> -p MemoryCurrent -p MemoryMax -p ManagedOOMSwap -p ManagedOOMMemoryPressureIf systemd-oomd is installed, inspect its log and control view:
journalctl -u systemd-oomd
oomctlThe unit’s cgroup may have reached its own memory limit even while the VPS still had free RAM. Conversely, a unit may have no limit and consume memory needed by every other service. Distinguishing a cgroup kill from a system-wide kernel kill determines whether you should adjust that unit, the workload, or the VPS size.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
5. Interpret provider-side symptoms correctly
High RAM or CPU usage on a VPS is normally caused by applications or kernel processes running on that VPS, not by an abstract hosting fault. Start with the process and cgroup named in the OOM record. Check recent deployments, traffic changes, imports, backups, compilers and cron jobs before changing kernel policy.
Recover a VPS that is already unresponsive
Use a second SSH session, serial console or provider console if the primary session is stalled. Your first goal is to release memory without creating another large allocation.
- Stop the identified noncritical service. Use its service manager rather than launching a replacement process. For example, run
systemctl stop <unit>only after confirming the unit is safe to interrupt. - Pause competing jobs. Stop a build, import, backup or batch worker that is consuming the remaining headroom. Avoid starting editors, package managers or diagnostic tools that may allocate substantial memory.
- Capture the evidence. Save kernel and service logs while the system is still reachable. Note the time, PID, command, cgroup and workload event that preceded the kill.
- Restart only after the pressure source is contained. A restart policy can restore availability, but repeatedly restarting a leaking process can create a kill-and-restart loop.
- Reboot only as a last-resort recovery step. If no process can be stopped and the console is the only access path, reboot, then immediately inspect
journalctl -k -b -1and the previous service logs.
Do not run a large recursive search, compile software or create a diagnostic archive while the VPS is critically short of memory. Recovery commands should be small and deterministic.
Add swap for emergency headroom
Swap is disk-backed virtual memory. It is slower than RAM, but it can turn an abrupt allocation failure into a period in which you can stop the offending workload. Swap also gives systemd-oomd more time to react to sustained pressure. It is not a substitute for sufficient physical memory: sustained swapping can cause severe latency and make a service appear frozen.
Check whether swap is absent or exhausted
swapon --show
free -hAn empty swapon --show result means no active swap area is available. If swap is listed but nearly full during normal operation, investigate the workload and disk latency before simply adding more.
Create and test a swap file
Use the commands documented for your distribution and filesystem. A conventional swap-file workflow is:
Rank #3
- OWC 64GB UPGRADE: Consists of 2pcs of 32GB DDR4 3200MHz PC4-25600 CL22 2RX8 ECC Unbuffered DIMM 1.2V 288-pin Memory Modules
- 100% COMPLIANT: With JEDEC Standard Specifications, ROHS Compliant, Warranty Safe Upgrade. Designed and Tested to Meet or Exceed all Manufacturer OEM Specs
- Compatible with Micron MTA18ADF4G72AZ-3G2B3 MTA18ASF4G72AZ-3G2B1 MTA18ASF4G72AZ-3G2F1Z MTA18ADF4G72AZ-3G2, Samsung M391A4G43BB1-CWE M391A4G43AB1-CWE, Hynix HMAA4GU7AJR8N-XN
- INDUSTRY LEADING: Consumer Friendly Advanced Replacement Program and Limited Lifetime Warranty, which Includes Free Tech Support by Other World Computing
- Works with Desktop, Workstation and Servers like: PowerEdge, Precision, StoreEasy, ProLiant, Apollo, ThinkServer, ThinkStation, ThinkSystem, System X and more
- Confirm free disk space. Run
df -hon the target filesystem. Leave room for logs, updates and application data. - Create the file. For a filesystem that supports it, allocate a file with a size chosen from measured peak demand and available disk, for example with
fallocate. Some filesystems require a zero-filled file instead. - Restrict permissions. Set mode
600so ordinary users cannot read swap contents:chmod 600 /swapfile. - Format it. Run
mkswap /swapfile. - Enable it immediately. Run
swapon /swapfile. - Verify activation. Run
swapon --showandfree -h; the new area should be listed and the available swap total should increase. - Make persistence deliberate. After testing, add a matching
/etc/fstabentry using your distribution’s documented syntax. A malformed entry can delay boot, so validate it before relying on it.
There is no universal swap-size ratio established for every VPS. Size it from measured peak usage, free disk, expected concurrency and the latency your service can tolerate. A small emergency reserve may be useful for bursts; a workload that continuously needs swap needs more RAM or lower demand.
Know when swap is hurting
- Rising swap-in and swap-out during normal traffic indicates sustained memory pressure, not a solved incident.
- Long request times, high I/O wait and an unresponsive SSH session can mean the VPS is thrashing.
- Swap does not protect a service from a cgroup
MemoryMaxlimit if that limit is intentionally reached. - Swap space on a full or failing filesystem cannot provide reliable headroom.
Fix the workload that exhausted memory
Use the process name, PID, cgroup and timing from the OOM record to choose the fix. Apply one change at a time and measure the result.
Web and application workers
Each worker may hold a runtime, framework state, request buffers and caches. Lower the worker or thread count until the worst expected concurrent request fits within the VPS budget. If a worker’s RSS grows after every request, investigate a leak and use a controlled worker recycle as containment rather than treating recycling as a cure. Keep enough workers for responsiveness, but reserve memory for the operating system, database and deployment tasks.
Databases
Database buffer pools, query work memory, connection counts and background maintenance can grow together. Compare configured cache sizes with the measured resident set and with memory used by the rest of the stack. Reduce cache or per-query memory where appropriate, cap connection concurrency, and schedule maintenance so it does not overlap with imports or traffic peaks. A database kill can corrupt in-flight work depending on the engine and operation, so prefer a graceful stop when possible.
Containers
Find the container’s cgroup rather than looking only at the host process list. Set a memory limit that leaves headroom for the host and other containers, then choose a restart policy that matches the service’s data-safety requirements. A limit that is lower than the service’s normal peak will produce predictable kills; measure first and increase gradually.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsBuilds, compilers and migrations
Parallel compilation, asset bundling, large language-model jobs, schema migrations and data imports often create short but extreme peaks. Reduce parallelism, process input in batches, or schedule the job away from request traffic. If a build runs in a unit or container, give it an explicit budget and fail the job cleanly instead of allowing it to evict unrelated services.
Scheduled jobs and deployment concurrency
Two individually safe jobs can exceed memory when they overlap. Review cron timers, queue workers, backups and deployment hooks. Stagger them, cap simultaneous workers and reserve a deployment window in which nonessential batch work is paused. Record peak RSS for each job so future changes can be compared against a known budget.
Contain the blast radius with systemd and cgroups
For a systemd service, use a drop-in rather than editing the vendor unit. First measure normal and peak usage, then create an override:
Rank #4
- ECC REGISTERED UPGRADE: This type of memory is used in Workstations and Servers. It will NOT be compatible with standard desktop computers. Also, it cannot be mixed with UNBUFFERED memory.
- OWC 128GB UPGRADE: Consists of 8pcs of 16GB DDR4 3200MHz PC4-25600 CL22 2RX4 ECC Registered RDIMM 1.2V 288-pin Memory Modules
- 100% COMPLIANT: With JEDEC Standard Specifications, ROHS Compliant, Warranty Safe Upgrade. Designed and Tested to Meet or Exceed all Manufacturer OEM Specs
- MAXIMIZE YOUR SERVER: With OWC's ECC Registered Server Memory, Our RAM upgrades will extend the life of your old infrastructure or save money when building a new one
- INDUSTRY LEADING: Consumer Friendly Advanced Replacement Program and Limited Lifetime Warranty, which Includes Free Tech Support by Other World Computing
systemctl edit <unit>Add only the settings you have sized and tested, for example:
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →[Service]
MemoryMax=
ManagedOOMSwap=kill
ManagedOOMMemoryPressure=killReplace the comment with a real byte value or supported unit such as 512M; do not copy a limit blindly between VPS sizes. Reload the manager and restart during a controlled window:
systemctl daemon-reload
systemctl restart <unit>
systemctl show <unit> -p MemoryCurrent -p MemoryMax -p ManagedOOMSwap -p ManagedOOMMemoryPressureMemoryMax= bounds the unit’s memory cgroup. Ubuntu’s resource-control documentation explains that an OOM killer can be invoked inside the unit when memory cannot be contained under that limit. ManagedOOMSwap=kill and ManagedOOMMemoryPressure=kill allow systemd’s managed OOM behavior to act on the unit under the corresponding conditions.
Apply limits gradually. A mis-sized cap can create a predictable restart loop, kill a database during legitimate maintenance, or shift the pressure onto another unit. Keep the drop-in in configuration management and document why the value was chosen.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Treat sysctl tuning as workload-specific
Kernel memory policy changes affect the entire VPS. Save current values before changing them:
Free tools Windows power users keep installed
One-click scans. No signup required.
sysctl -a
cat /proc/sys/vm/overcommit_memory
cat /proc/sys/vm/swappiness
cat /proc/sys/vm/oom_kill_allocating_task
cat /proc/sys/vm/panic_on_oomChange one setting at a time, observe a representative workload and make persistent changes through a managed configuration drop-in rather than ad-hoc shell history.
| Setting | Documented behavior | Practical caution |
|---|---|---|
vm.overcommit_memory |
0 uses heuristic overcommit; 1 always overcommits; 2 uses strict accounting. In mode 2, the commit limit is calculated from RAM, swap and the overcommit ratio or configured kilobytes. |
Choose it for a measured allocation pattern. Strict accounting can make allocations fail earlier; always-overcommit can defer failure until memory is actually needed. |
vm.swappiness |
Controls how aggressively the kernel swaps pages. | It does not create memory. Judge changes with swap-in/out, latency and application behavior. |
oom_kill_allocating_task |
Changes victim-selection behavior when an OOM event occurs. | Changing the victim can protect one process while killing another that is more important. Test the failure mode, not just steady-state usage. |
panic_on_oom |
0 is the normal kill-and-continue behavior; 1 or 2 request panic behavior. |
Do not set 1 or 2 on an ordinary VPS unless you have a tested failover design. |
Sysctl tuning cannot compensate for an application that continually grows, unlimited worker concurrency or a VPS whose measured peak demand exceeds its memory budget.
Prevent the next OOM event
- Alert before exhaustion. Alert on available RAM, swap usage, swap-in/out and cgroup pressure while there is still time to stop a job or add capacity. An alert only after swap is full is a postmortem.
- Retain logs across reboots. Keep kernel, systemd and application logs long enough to correlate a kill with a deployment, request spike or scheduled task.
- Graph resident memory. Track RSS by service, container and job, not only host-wide totals. Include peak and 95th-percentile values where your monitoring system supports them.
- Test the largest expected operation. Exercise the biggest request, import, build and migration in a staging-sized environment. Include realistic concurrency and background jobs.
- Encode known ceilings. Put tested memory limits in systemd units or container configuration and alert before the ceiling is reached.
- Review every restart loop. Automatic recovery restores availability only when the underlying process can start within the available budget. Pair a restart policy with a leak fix or a lower workload.
When resizing the VPS is the right fix
Resize or migrate when measured peak demand remains above physical RAM plus acceptable swap headroom after you have reduced concurrency, fixed leaks and applied sensible service limits. Capacity expansion should follow that diagnosis: adding RAM to hide an accidental worker multiplication may postpone the incident, while a correctly sized service can benefit immediately from more memory.
Before resizing, record the peak resident memory of each major service, the amount of swap used at that peak, and the headroom required for kernels, caches, deployments and recovery tools. Choose a plan that leaves operational margin rather than matching the single highest sample. Verify current provider pricing and terms separately because those details change by provider, region and date.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Quick Recap
Choosing among remedies
| Remedy | Recovery speed | Kill or data-loss risk | Performance impact | Survives reboot | Operational complexity | Adds capacity or limits demand? |
|---|---|---|---|---|---|---|
| Stop the offending service or job | Immediate when access remains available | Depends on graceful shutdown and in-flight work | Removes that workload temporarily | No | Low | Limits demand |
| Add swap | Fast after activation | Reduces abrupt kills but does not remove application risk | Can introduce high latency and I/O pressure | Only after a tested /etc/fstab entry |
Moderate | Adds emergency headroom |
| Reduce workers, cache or parallelism | Fast to moderate | Usually low if rolled out gradually | May reduce throughput | Yes when configuration is persisted | Moderate | Limits demand |
| Systemd or cgroup memory limit | Immediate after reload and restart | Unit-local OOM kills or restart loops if mis-sized | Protects neighboring services; capped unit may be constrained | Yes | Moderate to high | Limits blast radius |
| Sysctl tuning | Variable | Can change which process is killed or when allocation fails | System-wide and workload-dependent | Yes only when persisted | High | Changes policy, not capacity |
| Resize the VPS | Depends on provider migration or reboot | Low from OOM itself; migration still requires a backup and maintenance plan | Usually improves headroom and reduces swapping | Yes | Provider-dependent | Adds physical capacity |
A compact incident checklist
- Read
journalctl -k -bandjournalctl -k -b -1; identify whether the kernel orsystemd-oomdacted. - Run
free -h,swapon --show,cat /proc/meminfoanddf -h. - Find the largest RSS users and map the PID to its service or cgroup.
- Stop the noncritical consumer from a second session or console.
- Add tested swap if none exists, while watching latency and I/O.
- Reduce the workload’s peak demand and add a measured unit or container limit.
- Change overcommit, swappiness or victim selection only for a demonstrated workload need.
- Resize when tested demand still exceeds the VPS memory budget after those controls are in place.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
