my VPS just ran out of RAM and I was forced to reboot it since I wasn't even able to ssh in.

My question is where should I look at (logs, etc) to find out which process was responsibile for the RAM burst?



Unless you see something in /var/log/messages (or some other file in /var/log - look around) you blew your chance: By rebooting you destroyed any state information your system had, and now you need to wait for the problem to happen again.

If you suspect a RAM leak I suggest monitoring your RAM/Swap usage and noting any processes that appear to be growing over time.

| improve this answer | |

When you can login, type top and press M (you can also do it with atop, htop, ...)

If you want to check the size (in kiloBytes) instead of percentage:

# ps -eo rss,pid,user,cmd --sort -rss | head
| improve this answer | |
  • Good procedure, but he needs the problem to happen again first. Might be beneficial to leave a terminal open running top so when the system blows up again that screen can be consulted. – voretaq7 Aug 30 '11 at 16:27

You should use a metric collection system like Munin or Cacti for historical graphing of your services.

| improve this answer | |
  • +1 for general sanity: properly configured monitoring & alerting will also warn you before the problem becomes so serious that you can't log in (say 80% of swap in use, or 80% of RAM if you have no swap) – voretaq7 Aug 30 '11 at 16:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.