One of the most frustrating experiences in Linux server administration is a complete system freeze caused by memory exhaustion. When a rogue process (such as a runaway database query or a memory-leaking application) consumes 100% of available RAM and Swap space, the Linux kernel struggles to allocate memory for basic operations. This often results in a completely unresponsive system that requires a hard physical reboot.
To prevent this, the Linux kernel includes a mechanism called the OOM (Out Of Memory) Killer. When the system reaches critical memory starvation, the OOM Killer steps in to aggressively terminate memory-hogging processes to keep the core operating system alive.
How to Verify the OOM Killer Status
In most modern Linux distributions (like Ubuntu, Debian, and CentOS), the OOM Killer is enabled by default. You can verify its current status by checking the kernel parameters.
Open your terminal and run:
cat /proc/sys/vm/oom-kill
If the output is 1, the OOM Killer is active. If the output is 0, it is disabled, leaving your system highly vulnerable to hard crashes.
How to Enable or Disable the OOM Killer
If you need to manually toggle the OOM Killer, you can use the sysctl command.
To temporarily enable it (until the next reboot):
sudo sysctl -w vm.oom-kill=1
To make this change permanent across reboots, you must edit the system control configuration file:
- Open the configuration file in a text editor:
sudo nano /etc/sysctl.conf
- Scroll to the bottom of the file and add the following line:
vm.oom-kill = 1
- Save the file (
Ctrl+O,Enter) and exit (Ctrl+X). - Apply the changes immediately by running:
sudo sysctl -p
How to View the OOM Killer Logs
When the OOM Killer activates, it sacrifices a process to save the system. It usually targets the process with the highest “badness score” (typically the one consuming the most memory that is not a critical system daemon).
If a service mysteriously crashes, you should always check the system logs to see if the OOM Killer was the culprit. You can grep the kernel messages for OOM events using this command:
dmesg -T | grep -i oom
The output will show you exactly when the kernel ran out of memory, which process was chosen as the victim, and the PID that was forcefully killed.