Linux out of memory: diagnose the OOM killer and stop the freezes
Confirm out-of-memory kills in the kernel log, find the memory hog, install earlyoom, and tune swappiness so your Linux box stays responsive.
What this covers
When a Linux machine runs out of RAM, it thrashes through swap, the desktop locks up, and the kernel's OOM killer silently terminates processes. This guide walks you from proof of the problem to a fix that keeps the system responsive.
Symptom
Confirm the kernel is actually killing processes (OOM)
Before tuning anything, prove the problem is memory. The kernel logs every out-of-memory kill, so scan dmesg for lines about the OOM killer choosing a victim. If you see 'Out of memory' or 'Killed process' entries with real timestamps, you have your diagnosis; if not, look for another cause.
dmesg prints kernel messages with seconds since boot by default; -T converts them to real dates and times.
$ dmesg -TCheck how much memory and swap is actually available
free -h shows used, free, and available memory plus swap in human-readable units. Focus on the 'available' column: if it is close to zero and swap is nearly full, the system is on the edge of thrashing — exactly the condition that precedes an OOM kill.
Use free -h to see used, free, and available memory plus swap in GB/MiB instead of raw kilobytes.
$ free -hFind the memory hog with htop
Launch htop and sort by memory (F6, then MEM%) to watch live which processes are consuming RAM. Color meters for memory and swap give you an at-a-glance picture, and you can identify the specific culprit process that keeps pushing the system into the OOM zone.
Launch an interactive process viewer with color meters for CPU cores, memory, and swap, plus search, sort, and kill controls.
$ htopTake a text snapshot with ps aux
If you need a record to compare over time or paste into a bug report, ps aux lists every process with owner, CPU, and memory columns in one shot. Look for processes whose %MEM keeps climbing between snapshots.
Use the classic ps aux command to list every process on the system with owner, CPU, memory, and command columns.
$ ps auxInstall earlyoom so the desktop never freezes again
Without earlyoom, Linux waits until memory is completely exhausted before killing anything — by which point the machine is often frozen in a swap storm. earlyoom kills the biggest memory consumer early, while the system is still responsive. Enable the service and confirm it is active; to roll back, disable it again.
Install a tiny daemon that kills memory hogs before Linux thrashes into an unresponsive swap storm.
$ sudo systemctl enable --now earlyoom▾ Undo
$ sudo systemctl disable --now earlyoomOptionally tune swappiness
vm.swappiness controls how eagerly the kernel swaps memory out. A lower value (e.g. 10) keeps more in RAM, which helps interactive desktops that thrash; check the current value first, then set the new one live. Undo by restoring the default of 60. This changes behavior immediately but does not persist across reboots.
sysctl reads and writes live kernel parameters; vm.swappiness controls how eagerly the kernel swaps out memory.
$ sysctl vm.swappiness && sudo sysctl -w vm.swappiness=10▾ Undo
$ sudo sysctl -w vm.swappiness=60Verify with vmstat
Run vmstat over a few intervals and watch the si/so (swap in/out) columns. After the fix, swap activity should be near zero and processes should not be stuck in I/O wait (b column). Steady, low swap traffic means memory pressure is under control.
vmstat gives a compact one-line-per-interval view of CPU usage, swap activity, and I/O waits that top doesn't summarize as clearly.
$ vmstat 2 5How to confirm it worked
vmstat shows near-zero swap in/out activity and available memory stays comfortably above zero after a normal workload.
Undo everything
Every command above can be reverted. Run these in order to undo all of it.
$ sudo sysctl -w vm.swappiness=60
sudo systemctl disable --now earlyoomReview before running — some steps may not be independent.
Sources
- dmesg(1) - Linux manual pageEvidence: The -T, --ctime option decodes timestamps into a human-readable format, and -w (--follow) waits for new kernel messages.
- free(1) - Linux manual pageEvidence: free displays the total amount of free and used physical and swap memory, and -h shows all output fields automatically scaled to human-readable units.
- htop(1) — interactive process viewerEvidence: The htop man page describes it as an interactive text-mode process viewer that allows scrolling vertically and horizontally, unlike top.
- htop - an interactive process viewerEvidence: The official htop site describes real-time CPU, memory, and swap meters plus interactive process sorting and killing.
- Ubuntu Manpage: ps - report a snapshot of the current processesEvidence: "ps displays information about a selection of the active processes"; the u option selects the user-oriented format with USER, %CPU, %MEM, and COMMAND headers.
- ps - report a snapshot of the current processesEvidence: The ps page documents the a, u, and x options ("u Display user-oriented format" including USER, %CPU, %MEM, and COMMAND columns) and describes ps as reporting "a snapshot of the current processes".
- earlyoom - Early OOM DaemonEvidence: README instructs installing the package and running sudo systemctl enable --now earlyoom, and documents defaults like -m 5 (kill at 5% RAM) and --prefer.
- earlyoom README (raw)Evidence: Shows earlyoom.service and 'sudo systemctl enable --now earlyoom' plus tuning flags -m, --prefer and the low-memory kill logic.
Last verified: 2026-09-21
Related guides
A terminal-first workflow to diagnose high CPU usage on Linux, identify the responsible process or service, and fix it without losing your work.
A practical checklist for finding which ports are open on a Linux machine or across your network, from local sockets to a full nmap scan.
Diagnose high I/O wait on Linux: find the saturated disk and the process causing it, then lower its I/O priority so the system responds again.