oomkill.bt(8)

📦
version 0.27.0 · 4 versions
, in alpine 3.24, arch rolling, centos-stream 10, centos-stream 9, nixos 26.05, nixpkgs unstable, ubuntu resolute, ubuntu stonking

💀 oomkill.bt — bestie's guide to the OOM killer

okay so you found the oomkill.bt page in the System Manager's Manual, section 8 (that's the user commands bit, for the sysadmin girlies). it's a bpftrace/eBPF joint and it's about to be your new fave, fr fr. 🫶

✨ NAME ✨

oomkill.bt — trace the OOM killer. uses bpftrace/eBPF. that's it, that's the whole vibe. 🎀

🌸 SYNOPSIS 🌸

oomkill.bt

just the one line. no flags, no drama, no options to memorise. iconic honestly. 💅

💖 DESCRIPTION 💖

so like, this little icon traces the kernel out-of-memory killer — yes, the guy who shows up when your RAM situation is giving absolutely not — and prints the basic deets, including the system load averages at the time of the OOM kill. 🫠

why do you care about load averages, bestie? because they give you context on the system state at that moment: was it getting busier, or was it steady? that's literally what load averages tell you. so you can go "ah, it was climbing the whole time" or "no, it was chill and then just died," and either way you're now the main character of the postmortem. 👑

this tool is also lowkey perfect to customize for investigations, and that's not me being vague, that's the manpage: for example, by adding other task_struct details at the time of the OOM, or by adding other commands to run at the shell. go off, make it yours. ✨

⚠️ since this uses BPF, only the root user can use this tool. no root, no tool, no exceptions, sorry babe. 💀

🧚 REQUIREMENTS 🧚

  • CONFIG_BPF
  • bpftrace

that's the whole checklist. two things. slay. ✅

🌈 EXAMPLES 🌈

trace OOM kill events:

# oomkill.bt

just run it as root and watch the chaos unfurl. 🍓

👑 FIELDS 👑

here's what all the output lines mean, so you can read it like a pro:

  • Triggered by ... — the process ID and process name of the task that was running when another task was OOM killed. so, the bystander. the witness. the "not me" of the situation. 🙈
  • CGROUP ... — if the OOM occurs in the memory cgroup, display the memory cgroup information.
  • OOM kill of ... — the process ID and name of the target process that was OOM killed. that's the one who got got. 😭
  • loadavg — contents of /proc/loadavg. the first three numbers are the 1, 5, and 15 minute load averages (where the average is an exponentially damped moving sum, and those numbers are constants in the equation); then there's the number of running tasks, a slash, and the total number of tasks; and then the last number is the last PID to be created.

🦋 OVERHEAD 🦋

Negligible. ✨ not even a blip. your system won't notice. periodt.

💜 SOURCE 💜

this is from bpftrace.

https://github.com/bpftrace/bpftrace

also look in the bpftrace distribution for a companion _examples.txt file containing example usage, output, and commentary for this tool. it's giving free extra lore, go read it. 📖

this is a bpftrace version of the bcc tool of the same name. the bcc tool may provide more options and customizations — so if you're craving more knobs, that's where to look.

https://github.com/iovisor/bcc

🌸 OS 🌸

Linux

💅 STABILITY 💅

Unstable — in development.

so like, it's growing, it's evolving, it's on its journey. use it, love it, but know it's still cooking. 🧑‍🍳

🫶 AUTHOR 🫶

Brendan Gregg, Rong Tao

legends, no cap. 👑

🔥 SEE ALSO 🔥

and that's the whole page, bestie!! 💖 this one's from the USER COMMANDS section, dated 2018-09-07, and it lives in the System Manager's Manual alongside its fellow section-8 girlies. go trace some OOM kills and stay hydrated. 🌈✨🎀

📦 where this page comes from