Swap and memory pressure - when the system runs out of RAM

Swap is the kernel’s safety valve when RAM runs out. This lesson covers how swap works, when to use it, and how to manage memory pressure.

What swap is

Swap is disk space used as overflow RAM. When the kernel needs more memory than RAM provides, it:

1. Writes anonymous pages to swap.
2. Frees the page frames.
3. Reads them back when needed (page fault).

Swap is slower than RAM (disk I/O vs memory access), but without it, the OOM killer runs.

Types of swap

For servers, use a swap partition or file. For laptops and low-RAM devices, zram.

Configure swap

# Create swap partition (replace /dev/sdX with actual device)
mkswap /dev/sdX
swapon /dev/sdX

# Create swap file
fallocate -l 4G /swapfile
chmod 600 /swapfile
mkswap /swapfile
swapon /swapfile

# Make permanent in /etc/fstab
echo '/dev/sdX none swap sw 0 0' >> /etc/fstab
echo '/swapfile none swap sw 0 0' >> /etc/fstab

Swappiness

/proc/sys/vm/swappiness:

• 0: avoid swap (use only when RAM is critical).
• 60 (default): kernel reclaims cache first, then swaps.
• 100: aggressive swap.

cat /proc/sys/vm/swappiness
echo 10 > /proc/sys/vm/swappiness

For databases (memory-sensitive), set low (10). For general workloads, default 60 is fine.

Detect memory pressure

Before OOM:

# Watch swap activity
vmstat 1
# si/so: swap in / out per second
# If > 0 consistently, memory pressure

# Watch page scan rate
sar -B 1
# pgscank/s: page scans per second (high = pressure)

# Check PSI (Pressure Stall Information)
cat /proc/pressure/memory
# some avg10=0.00    # % of time at least one process was stalled
# full avg10=0.00

PSI is a more modern way to detect pressure. >5% sustained indicates real pressure.

OOM events

sudo dmesg | grep -i 'out of memory\|killed process'
sudo journalctl -k | grep -i oom

Two lines are emitted per kill. Grep for oom-kill: as well — that is the line that says whether the host ran out or a single cgroup did.

# global OOM - the host itself ran out of memory
oom-kill:constraint=CONSTRAINT_NONE,nodemask=(null),cpuset=/,mems_allowed=0,
  oom_memcg=(null),task_memcg=/system.slice/myapp.service,task=java,pid=1234,uid=0
Out of memory: Killed process 1234 (java) total-vm:8234560kB anon-rss:4123456kB

# cgroup OOM - one unit exceeded its own memory.max; the host was fine
oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=myapp.service,
  mems_allowed=0,oom_memcg=/system.slice/myapp.service,
  task_memcg=/system.slice/myapp.service,task=java,pid=1234,uid=0
Memory cgroup out of memory: Killed process 1234 (java) total-vm:8234560kB anon-rss:4123456kB

The process name, PID, and memory usage are recorded, but the diagnosis lives in constraint=. CONSTRAINT_NONE with oom_memcg=(null) is a host capacity problem — swap sizing, total commitment, or RAM. CONSTRAINT_MEMCG with a named oom_memcg= is one unit over its limit, and nothing about the host’s swap or memory totals needs to change. cat /sys/fs/cgroup/<unit-path>/memory.events gives the same attribution without the log.

Prevent OOM

• Set memory limits (cgroup MemoryMax).
• Enable swap (even small swap helps).
• Tune swappiness.
• Monitor memory pressure (PSI, vmstat).
• Alert before OOM.

Knowledge check