How do I check whether Linux killed a process because of memory pressure?
An out-of-memory kill can occur because the whole system is under pressure or because a service/container exceeds a smaller memory limit. A process disappearing is not enough evidence on its own. Correlate kernel messages, service exit information and the resource policy that applied at the time.
Before you start
- An authorised SSH session on the Linux server.
Instructions
1. Search the relevant kernel time window
Use a bounded interval and inspect the complete matching event, including the affected process or cgroup. grep returning no matches is different from journal access failing.
sudo journalctl -k --since "1 hour ago" --no-pager | grep -Ei "out of memory|oom-kill|killed process"This looks for common OOM wording. Retention and kernel message formats vary, so absence of a match is not a universal exclusion.
2. Inspect the affected service limits
Choose the actual unit rather than assuming host memory alone controls it. Also review application concurrency and recent allocation growth.
systemctl show example.service -p Result -p MemoryCurrent -p MemoryMax -p OOMPolicyA memory ceiling can explain a kill even when other parts of the host still have available RAM. Property availability depends on systemd version.
Check the result
- The process exit is tied to an OOM event or another evidenced cause. The corrective plan addresses the applicable limit or allocation behaviour and is tested under representative load.
Troubleshooting
- The process was killed without an OOM message
- Check service timeouts, administrator actions, container events and application crash records.
- Restarting temporarily fixes it
- Measure memory growth and concurrency; repeated restarts can conceal the underlying problem.
Official references
Use the documentation for your installed version when a flag, service name or platform feature differs.