Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

my VPS just ran out of RAM and I was forced to reboot it since I wasn't even able to ssh in.

My question is where should I look at (logs, etc) to find out which process was responsibile for the RAM burst?


share|improve this question

Unless you see something in /var/log/messages (or some other file in /var/log - look around) you blew your chance: By rebooting you destroyed any state information your system had, and now you need to wait for the problem to happen again.

If you suspect a RAM leak I suggest monitoring your RAM/Swap usage and noting any processes that appear to be growing over time.

share|improve this answer

When you can login, type top and press M (you can also do it with atop, htop, ...)

If you want to check the size (in kiloBytes) instead of percentage:

# ps -eo rss,pid,user,cmd --sort -rss | head
share|improve this answer
Good procedure, but he needs the problem to happen again first. Might be beneficial to leave a terminal open running top so when the system blows up again that screen can be consulted. – voretaq7 Aug 30 '11 at 16:27

You should use a metric collection system like Munin or Cacti for historical graphing of your services.

share|improve this answer
+1 for general sanity: properly configured monitoring & alerting will also warn you before the problem becomes so serious that you can't log in (say 80% of swap in use, or 80% of RAM if you have no swap) – voretaq7 Aug 30 '11 at 16:28

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.