earlyoom: Prevent OOM Crashes on Linux Servers

earlyoom is a lightweight daemon that monitors available RAM and swap continuously. When free memory drops below a configured threshold, it proactively sends SIGTERM to the process consuming the most memory, then SIGKILL if necessary. This prevents the Linux kernel's built-in OOM killer from acting too late and unexpectedly terminating critical services like Apache, MySQL, or Nginx.

Overview

The problem earlyoom solves:

• Memory exhaustion: Runaway process consumes all RAM
• System freeze: Kernel OOM killer acts unpredictably, crashes random processes
• Service outage: Apache/MySQL/Nginx gets killed, site goes down
• No warning: Customers don't know what happened; logs are unhelpful

earlyoom solution:

• Monitors memory proactively (check every 100ms)
• Targets memory hogs BEFORE kernel OOM killer
• Kills least-essential process (Firefox, backup scripts, bots)
• Protects critical services (Apache, MySQL, SSH)
• Logs every action for debugging

When You Need earlyoom

Symptoms your server needs earlyoom:

• Server becomes unresponsive when RAM exhausted
• Need to reboot after memory spike
• Random service crashes without clear reason
• Running memory-intensive backups or data processing
• Multiple tenants/apps sharing one server
• Limited swap space (can't rely on swap to save you)

Real example: Customer VPS (4GB RAM, 6GB swap) experienced full memory exhaustion on June 4th. Kernel OOM killer killed Apache unexpectedly. earlyoom would have terminated the offending backup process instead, keeping Apache online.

earlyoom vs Kernel OOM Killer

Installation Steps

Step 1: Check and enable EPEL repository (if needed)

earlyoom is in the EPEL repository, not default repos:

# Check if EPEL already enabled
dnf repolist | grep epel

# If not found, enable it
dnf install epel-release -y
dnf makecache

Step 2: Install earlyoom

dnf install earlyoom -y

Step 3: Enable at boot**

systemctl enable earlyoom

Step 4: Verify installation**

which earlyoom
earlyoom --version

Configure Thresholds

Edit configuration file:

nano /etc/default/earlyoom

Recommended configuration (for 4GB+ RAM servers):**

EARLYOOM_ARGS="-m 10,5 -s 75 -r 3600 --prefer '(httpd|mysqld|php-fpm|nginx)' --avoid '(^|/)(init|sshd|systemd)$'"

Configuration explanation:

Custom threshold for small RAM (1-2GB):**

# Trigger earlier on small servers
EARLYOOM_ARGS="-m 15,8 -s 60"

Custom threshold for large RAM (8GB+):**

# Trigger later on large servers (more buffer)
EARLYOOM_ARGS="-m 5,2 -s 80"

Save config: Ctrl+X → Y → Enter

Set permissions:**

chown root:root /etc/default/earlyoom
chmod 0644 /etc/default/earlyoom

Monitor & Verify

Start the service:**

systemctl restart earlyoom
systemctl status earlyoom

Expected output: ● earlyoom.service - Early OOM Daemon active (running)

Watch earlyoom in real-time:**

journalctl -u earlyoom -f

Review past kill events:**

# Show all earlyoom actions
journalctl -u earlyoom | grep -i "kill\|term"

# Show specific process kill
journalctl -u earlyoom | grep "sending SIGKILL"

Confirm at boot time:**

systemctl is-enabled earlyoom   # Returns: enabled
systemctl is-active earlyoom    # Returns: active

Email Alerts on Kill Events

Optional: Notify admin when earlyoom kills a process

Create notification script:**

cat > /usr/local/bin/earlyoom-notify.sh << 'SCRIPT'
#!/bin/bash
HOSTNAME=$(hostname)
TIMESTAMP=$(date '+%Y-%m-%d %H:%M:%S')
PROCESS=$(journalctl -u earlyoom -1 --no-pager | grep -i kill | tail -1)

echo "⚠️  OOM Kill Event on $HOSTNAME at $TIMESTAMP" | \
  mail -s "[UnderHost Alert] OOM Kill on $HOSTNAME" root

# Optional: Log to file
echo "$TIMESTAMP - $PROCESS" >> /var/log/earlyoom-alerts.log
SCRIPT

chmod +x /usr/local/bin/earlyoom-notify.sh

Update earlyoom config to use notify script:**

nano /etc/default/earlyoom

Add to EARLYOOM_ARGS:**

--notify /usr/local/bin/earlyoom-notify.sh

Reload:

systemctl restart earlyoom

Note: cPanel/DirectAdmin servers have sendmail configured by default. Root email is typically forwarded to your WHM contact address.

Troubleshooting

earlyoom won't start:**

# Check for config errors
systemctl status earlyoom

# View detailed error
journalctl -u earlyoom -n 20

Syntax error in /etc/default/earlyoom:**

# Test config syntax
earlyoom -h | grep "EARLYOOM_ARGS"

# Or validate manually
bash -n /etc/default/earlyoom

earlyoom not killing processes:**

• Check thresholds: cat /etc/default/earlyoom
• Verify service is running: systemctl status earlyoom
• Lower the memory threshold: -m 20,10 (more aggressive)
• Check logs: journalctl -u earlyoom -f

Too many false positives (killing legitimate processes):**

• Raise threshold: -m 5,2 (wait longer before killing)
• Adjust prefer/avoid list for your use case
• Review killed processes: journalctl -u earlyoom | grep SIGTERM

Check actual memory usage:

free -h                          # Overall memory
ps aux --sort=-%mem | head -10  # Top memory consumers
vmstat 1 5                       # Memory activity

Uninstall if needed:

systemctl stop earlyoom
systemctl disable earlyoom
dnf remove earlyoom -y

Related: Resource monitoring | System optimization | cgroup limits | Swap management