1

I'm aware OOM killer save info about a pid in syslog, but I would like to collect also cmdline & owner of process being killed.

Info is relevant for debugging and ELK metrics, just PID isn't helpful. I couldn't find a tool or an easy way to do so,

any clever ideas?

NoamD
  • 11
  • 1

1 Answers1

0
echo 1 > /proc/sys/vm/oom_dump_tasks

which seems is the most that you can get the kernel to display on out-of-memory errors.

https://www.kernel.org/doc/Documentation/sysctl/vm.txt

Enables a system-wide task dump (excluding kernel threads) to be produced when the kernel performs an OOM-killing and includes such information as pid, uid, tgid, vm size, rss, nr_ptes, swapents, oom_score_adj score, and name. This is helpful to determine why the OOM killer was invoked, to identify the rogue task that caused it, and to determine why the OOM killer chose the task it did to kill.

If this is set to zero, this information is suppressed. On very large systems with thousands of tasks it may not be feasible to dump the memory state information for each one. Such systems should not be forced to incur a performance penalty in OOM conditions when the information may not be desired.

If this is set to non-zero, this information is shown whenever the OOM killer actually kills a memory-hogging task.

Edit

As per Where can I see a list of kernel killed processes?

Process Accounting could help here.

In brief:

apt-get install acct

Then try commands like:

lastcomm
sa

or on Ubuntu:

lastcomm -f /var/log/account/pacct
sa /var/log/account/pacct

See:

Bart
  • 2,221