DE

↑ ↓ select, Enter open, Esc close

Find processes killed by the OOM killer

harmless rootProcessesdebian, ubuntu
root@server
journalctl -k --no-pager | grep -iE "out of memory|oom-kill|killed process"

Filters the kernel messages in the journal for the typical OOM killer lines. The Killed process line names the PID, program name and memory usage of the killed process. The most common case on web servers: MariaDB or php-fpm vanish without an error message of their own.

Note: Without a persistent journal, kernel messages only go back to the last boot. On systems with rsyslog, zgrep -i "killed process" /var/log/kern.log* also helps.

Also searched as

  • mysql was suddenly killed
  • find oom killer log
  • process killed out of memory
  • out of memory killed process

Related one-liners

All in Processes

Show logs from the previous boot

#journalctl -b -1 -n 200 --no-pager
harmlessLogs

Find out which processes are using swap

$for f in /proc/[0-9]*/status; do awk '/^Name:/ {n=$2} /^VmSwap:/ {print $2, "kB", n}' "$f"; done 2>/dev/null | sort -rn | head -15
harmlessProcesses

Show processes with the highest RAM usage

$ps -eo pid,user,%mem,rss,cmd --sort=-rss | head -15
harmlessProcesses

Sum up RAM usage per program

$ps -eo rss=,comm= | awk '{a[$2]+=$1} END {for (p in a) printf "%8.1f MB %s\n", a[p]/1024, p}' | sort -rn | head -15
harmlessProcesses

Count IP addresses blocked by ufw

#journalctl -k --since "today" --no-pager | grep 'UFW BLOCK' | grep -o 'SRC=[^ ]*' | sort | uniq -c | sort -rn | head -20
harmlessFirewall

IP addresses with the most failed SSH logins

#journalctl -u ssh --since "24 hours ago" --no-pager | grep -oE 'Failed password for .* from [0-9a-f.:]+' | awk '{print $NF}' | sort | uniq -c | sort -rn | head -20
harmlessSecurity

Read first, then run.

The commands on myline.de act directly on servers, files and databases. A wrong path or placeholder can delete data irreversibly or make a server unreachable.

  • All commands are provided without warranty and are not tested on every system.
  • Understand what a command does before running it, and check every placeholder.
  • Make a backup first and, if possible, try it on a test system.
  • You run commands at your own risk. Liability for damages is excluded to the extent permitted by law.