iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
A Linux out-of-memory (OOM) message tells you that a memory policy boundary was reached and a supervisor killed something; it does not, by itself, prove a memory leak. Start by identifying which supervisor acted—the kernel OOM killer, a cgroup limit, or systemd-oomd—then correlate the event with per-process memory samples and cgroup pressure. A leak is a trend: memory that keeps growing through equivalent workload cycles and does not return when the work stops.
This guide gives a repeatable workflow for confirming the event, finding the selected process and competing consumers, distinguishing a leak from legitimate workload growth or allocator retention, and choosing the right user-space, kernel-space, limit, capacity, or policy fix.
What an OOM event actually means
Linux can run out of reclaimable memory at the host level, inside a cgroup, or according to an early-pressure policy. The resulting log may look similar while the cause and remedy differ.
Kernel OOM killer
The kernel invokes its OOM path when it cannot satisfy an allocation under the current reclaim, swap, and overcommit rules. The panic_on_oom virtual-memory setting controls the response: documented values 0, 1, and 2 select normal OOM-killer behavior or a kernel panic policy. With the normal setting, the kernel selects a candidate using a badness heuristic. Kernel documentation describes the base score as 0 (never kill) through 1000 (always kill); oom_score_adj changes a task’s preference in that decision. High RSS alone is not proof of a leak: a healthy batch job can simply be the largest eligible consumer when the host is exhausted.
#1 Best Overall
- Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
- With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
- Wide Application: attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
- Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
- Economical &Reusable: Built durable materials with a long-lasting battery,our CAGIWIRU air duster it's a sustainable alternative to disposable air cans.
If oom_dump_tasks is enabled, the kernel can log task details, including process identifiers, RSS-related values, swap usage, and oom_score_adj. Preserve those lines before restarting services or rotating journals.
Cgroup memory limit
A service or container can hit its own cgroup-v2 budget while the host still reports free memory. The cgroup controller accounts usage and may reclaim or kill tasks in that hierarchy when memory.max is reached. This is a scope-limited OOM, not evidence that the entire machine ran out of RAM.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemssystemd-oomd intervention
systemd-oomd monitors cgroups-v2 together with pressure stall information (PSI) and can terminate a configured unit before the kernel-space OOM path. Its D-Bus interface reports the affected cgroup and a reason such as memory-used or memory-pressure. The documented Killed() signal was added in systemd version 252. A unit killed this way can therefore coincide with free host memory.
Step 1: Confirm the event and its scope
Collect evidence from the boot in which the failure occurred and from the service manager that owns the process. Run:
journalctl -k -b -1
dmesg -T
journalctl -u your-service.service --since '2 hours ago'
Replace -b -1 with the relevant boot identifier if the incident is current. Search for phrases such as Out of memory, Killed process, oom-kill, or messages from systemd-oomd. Record the timestamp, PID, command name, parent PID when shown, systemd unit or container, and whether the message identifies a global allocation failure or a cgroup.
Rank #2
- Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
- Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
- Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
- Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
- Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
Do not infer the cause from an application log that merely says it was terminated. The kernel journal, unit journal, and cgroup event counters are the authoritative places to establish who acted.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Step 2: Snapshot host memory and competing consumers
Take a host-wide snapshot close to the event:
ps -eo pid,ppid,comm,%mem,rss,vsz --sort=-rss
free -h
swapon --show
cat /proc/meminfo
rssis resident memory in the process listing;vszis virtual address space and can be much larger without representing committed RAM.free -hshows total, used, available, and reclaimable memory in human-readable units. Compare the available value and swap activity, not just the used column.swapon --showconfirms whether swap exists and where it is configured. Swap can absorb cold pages, but it cannot repair an unbounded allocation rate or an incorrectly sized cgroup./proc/meminfoprovides counters such as anonymous memory, page cache, slab, and swap totals for comparison with later samples.
For a candidate PID, capture the process-level views together:
PID=1234
cat /proc/$PID/status
cat /proc/$PID/oom_score
cat /proc/$PID/oom_score_adj
cat /proc/$PID/smaps_rollup
/proc/<pid>/status gives a compact view including resident and virtual totals, thread count, and other process attributes. oom_score is the current OOM-killer score; oom_score_adj is the administrator- or service-supplied adjustment that changes kill preference. Treat adjustments as policy, not as a way to reclaim memory.
Step 3: Understand the process memory files
The proc files answer different questions, so choose the least expensive view that still explains the symptom.
| File | Use it for | What it tells you |
|---|---|---|
/proc/<pid>/status |
Fast point-in-time checks | Aggregate virtual and resident figures, threads, and process metadata. |
/proc/<pid>/maps |
Mapping layout | Address ranges, permissions, file paths, anonymous regions, and shared libraries. |
/proc/<pid>/smaps |
Explaining growth | Per-mapping RSS, private and shared clean/dirty pages, referenced pages, and other accounting. |
/proc/<pid>/smaps_rollup |
Repeated sampling | A convenient aggregate of the same mapping categories without parsing every mapping. |
/proc/<pid>/numa_maps |
NUMA placement | How pages are distributed across NUMA nodes when locality is part of the problem. |
Use smaps_rollup at a fixed interval to make a growth curve. When a category rises, switch to smaps to identify the mappings responsible. Anonymous growth often points toward heap allocations, thread stacks, or anonymous mmaps; file-backed growth can be cache or mapped-file behavior; shared growth may be expected sharing rather than a private leak.
Rank #3
- 【Large size】：Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
- 【LED backlight mouse pad】：Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
- 【Anti-slip rubber base】：Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
- 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
- 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.
Step 4: Inspect cgroup-v2 limits and pressure
Find the service or container’s cgroup path, then read its controller files. For a systemd unit, systemctl status your-service.service shows the unit state and usually enough context to locate its hierarchy. In that hierarchy inspect:
cat memory.current
cat memory.max
cat memory.high
cat memory.events
cat memory.pressure
memory.currentis current accounted usage.memory.maxis the hard limit; a finite value explains a service-level OOM even when host memory remains.memory.highis a throttling and reclaim boundary intended to apply pressure before the hard limit.memory.eventscontains counters for events such as high-threshold pressure, max-limit hits, OOM decisions, and OOM kills. Save the file before and after a reproduction so you can see which counter increments.memory.pressureexposes PSI totals and averages. Rising sustained pressure indicates stalled work even if the instantaneous usage is below the limit.
Correlate those files with:
systemctl status systemd-oomd
journalctl -u systemd-oomd --since '2 hours ago'
The systemd-oomd D-Bus status identifies the cgroup and reason for an action. If the unit’s counters rise but global kernel logs do not show a host OOM, focus on the unit’s limit, workload burst, and pressure policy rather than adding RAM first.
Step 5: Decide whether the pattern is a leak
One large sample cannot distinguish a leak from a legitimate peak. Reproduce a representative workload and sample at fixed intervals, for example every 10 seconds:
PID=1234
while sleep 10; do
printf '%s ' "$(date --iso-8601=seconds)"
awk '/VmRSS|VmSize|Threads/ {printf "%s=%s ", $1, $2$3} END {print ""}' /proc/$PID/status
awk '/Rss:|Pss:|Private_Dirty:|Anonymous:|AnonHugePages:|Swap:/ {sum[$1]+=$2} END {for (k in sum) printf "%s=%s kB ", k, sum[k]; print ""}' /proc/$PID/smaps
done
Keep the workload, input size, concurrency, and process lifetime consistent. A stronger leak hypothesis has all of these characteristics:
- RSS, anonymous, or mapped memory rises across repeated equivalent cycles.
- The rise continues after each cycle finishes and the workload becomes idle.
- Memory is not returned during a long quiescent period or after an explicit cache flush.
- The same allocation or mapping category grows in multiple runs.
A step increase during a known batch, a plateau that tracks concurrency, or memory retained by an allocator for future reuse is more consistent with workload sizing or allocator behavior than with a continuously lost allocation. Check open file descriptors, thread count, mmap count, and application cache statistics alongside memory. A rising thread count can explain growing stack mappings; descriptor or connection growth can reveal an ownership bug outside the heap.
Rank #4
- 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
- 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
- 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
- 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
- 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
Step 6: Find user-space leaks with Valgrind Memcheck
Use Valgrind Memcheck on a representative test binary, preferably in a staging environment because instrumentation is slow and changes timing. A standard invocation is:
valgrind --tool=memcheck --leak-check=full --show-leak-kinds=all ./programThe official Valgrind manual dated 20 May 2026 documents version 3.27.1. Capture the complete report and the allocation stack traces. Interpret the leak kinds rather than treating every line as an actionable defect:
- Definitely lost: no pointer to the allocated block remains; this is the clearest ownership failure.
- Indirectly lost: the block is reachable only through another block that was lost; fix the owning loss first.
- Still reachable: pointers remain at process exit. This may be intentional global state or a cache, though it deserves review when it grows during a long run.
- Possibly lost: Memcheck cannot prove that all interior-pointer patterns are valid; inspect the allocation and pointer representation before changing code.
Run the same scenario more than once. Compare leak summaries and stacks, and test both a clean shutdown and a workload that repeats without exiting. Memcheck confirms user-space allocation behavior; it does not diagnose a kernel slab leak or a cgroup policy.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Step 7: Investigate suspected kernel memory leaks
If user processes remain stable while slab or other kernel counters grow, inspect kernel allocations:
cat /proc/slabinfo
slabtop
cat /proc/meminfo
For deeper analysis, the kernel must be built with CONFIG_DEBUG_KMEMLEAK, and debugfs must be mounted. Read the scanner interface:
Best Value
- 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
- 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
- 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
- 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
- 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.
cat /sys/kernel/debug/kmemleak
echo scan > /sys/kernel/debug/kmemleak
cat /sys/kernel/debug/kmemleak
Kmemleak’s automatic scanner runs every 600 seconds by default. Its output lists possible unreferenced objects, not proven leaks; validate findings against driver activity, slab growth, and a reproducible workload. The method is intended for kernel allocations and is complementary to Valgrind’s user-space checking.
Choosing the right diagnostic method
| Approach | Visibility | Best question | Cost and limits |
|---|---|---|---|
| Kernel journal and OOM fields | Host event and selected task | Who was killed, when, and under which OOM path? | Low overhead; only a point-in-time explanation. |
status and smaps_rollup sampling |
One process over time | Which memory category is growing? | Low to moderate overhead; needs a controlled workload. |
smaps and mapping inspection |
Per-region process detail | Which heap, stack, file, or anonymous mapping accounts for growth? | More parsing and read overhead; snapshots can be large. |
| cgroup files and PSI | Service or container scope | Did a local limit or sustained pressure trigger action? | Low overhead; does not identify the allocating line of code. |
| Valgrind Memcheck | User-space allocations | Which allocation path loses ownership? | High runtime and memory overhead; use a reproducible test. |
| kmemleak | Kernel allocations | Are unreferenced kernel objects accumulating? | Requires a suitable debug kernel and validation of possible findings. |
Remediation: match the fix to the evidence
Fix ownership and lifetime bugs
Use the allocation stacks from Memcheck and the mapping category from smaps to repair missing frees, abandoned containers, unbounded queues, forgotten callbacks, or cache entries without an eviction policy. Add regression tests that repeat the workload and assert a bounded post-cycle footprint.
Free tools Windows power users keep installed
One-click scans. No signup required.
Control workload growth
Cap worker and thread concurrency, bound queue length, paginate large batches, and apply back-pressure before all work is resident. If memory rises only with parallelism, reducing concurrency is a causal fix while the application’s peak requirement is redesigned.
Set service and container limits deliberately
Choose a MemoryMax= or container memory limit from measured steady-state and peak usage, with headroom for the operating system and bursts. Use memory.high to apply pressure before memory.max when the workload can slow down gracefully. A limit that is lower than a legitimate peak converts normal work into repeated OOM kills; a limit that is unlimited can let one service consume the host.
Add capacity or swap only when justified
Additional RAM addresses a real capacity deficit, not a lost allocation. Swap can protect against short-lived anonymous peaks and improve survivability, but monitor latency and swap-in activity. Verify that overcommit and swap settings match the workload instead of copying a setting from another host.
Define kill priority intentionally
Adjusting oom_score_adj changes which task is sacrificed. It does not reduce memory use, remove a leak, or increase the cgroup budget. Document why a process is protected or preferred for termination, and test the result during a controlled failure.
Recommended Free Tools
Address kernel findings
For a validated kmemleak or slab-growth issue, identify the responsible driver, module, or kernel version, then apply the vendor or upstream fix and verify that the relevant slab counters stop rising. Do not suppress a warning merely because kmemleak calls it “possible.”
Verification and ongoing prevention
- Save the original kernel and service journals, cgroup files, process samples, and workload parameters.
- Apply one causal change at a time so the effect is measurable.
- Run the same workload through several complete cycles, including an idle period after each cycle.
- Confirm that the growth curve flattens, cgroup event counters stop incrementing, and no new OOM or systemd-oomd actions occur.
- Keep alerts for RSS or cgroup usage,
memory.eventsOOM counters, PSI pressure, swap activity, thread count, and file-descriptor count.
For recurring incidents, retain time-series data rather than relying on a postmortem snapshot. Continuous PSI and cgroup alerting can tell you that pressure is returning, but alerts do not replace allocation tracing, leak testing, or examination of the kernel’s selected task.
Quick Recap
Quick incident checklist
- Did the kernel, a cgroup limit, or systemd-oomd terminate the process?
- What timestamp, PID, command, unit, container, and cgroup were involved?
- What did
free -h,swapon --show, and/proc/meminfoshow? - What are the process’s
status,oom_score,oom_score_adj, andsmaps_rollupvalues? - Did anonymous, file-backed, shared, or stack mappings grow across equivalent cycles?
- Did
memory.current,memory.max,memory.high, ormemory.eventsprove a cgroup boundary? - Does Memcheck reproduce a user-space ownership loss?
- Are slab counters or kmemleak findings implicating kernel memory?
- Which single remediation—code, concurrency, limit, capacity, swap, or policy—will be verified first?
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
