Memory Management: The Art of Balance

In the world of Linux, "Free RAM is Wasted RAM."

If you have 16GB of RAM and only 2GB is being used by your apps, the Linux kernel will use the other 14GB for its own "Working Disk Cache." This is why even a healthy Linux server often shows 95% "Used" memory in basic tools.

But what happens when you run out of actual room? In this lesson, we will learn how Linux handles the "Empty Tank" problem through Swap and the dreaded OOM Killer.

---

1. Swap: The Virtual Safety Net

Swap is a space on your hard drive designated as "Extra RAM."

• The Good: It allows the system to keep running even if RAM is full.
• The Bad: It is thousands of times slower than physical RAM. If your system is "Swapping," everything will feel slow.

The Swappiness Parameter:

This setting (vm.swappiness) tells Linux how "Eager" it should be to move data to the disk.

• 0 - 10: Avoid Swap at all costs. (Good for fast database servers).
• 60: The default.
• 100: Aggressively move everything to Swap to keep RAM empty for disk caching.

# Temporarily set swappiness to 10
sudo sysctl -w vm.swappiness=10

---

2. The OOM Killer: The Executioner

When the server is 100% out of RAM and 100% out of Swap, the kernel cannot function. To save itself, it picks a process and Kills it instantly.

Who does the OOM Killer pick?

It uses a "Score" system.

• High memory usage = High Score.
• Running for a short time = High Score.
• Running as a non-privileged user = High Score.

The result: Your expensive Java or Python application is often the first thing executed!

---

3. Practical: Tuning the OOM Score

You can "Protect" a critical process (like your SSH daemon) from being killed by the OOM killer.

# Tell the kernel that SSH is 'Special' and should NOT be killed
# -1000 is the lowest possible score (Immunity)
echo -1000 > /proc/$(pgrep sshd | head -n 1)/oom_score_adj

---

4. Identifying "Memory Pressure"

How do you know if you are almost out of RAM? Look for Memory Pressure (PSI). This is a modern kernel feature that measures "How long workers waited for memory."

# Check the pressure stats
cat /proc/pressure/memory
# Look for 'some' and 'full' values > 0.

---

5. Cleaning the Cache: Transparent Huge Pages (THP)

In high-performance databases (like Redis or MongoDB), a feature called "Transparent Huge Pages" can actually slow down the server by creating "Fragmentation." Most DB admins turn this off.

# Disable Huge Pages (common for database optimization)
echo never > /sys/kernel/mm/transparent_hugepage/enabled

---

6. Example: An OOM Incident Detector (Python)

If a process was killed by the OOM system, it won't be in your process list. Here is a Python script that scans the kernel logs to find the "Fingerprints" of a memory execution.

import subprocess

def check_for_oom_events():
    """
    Scans dmesg for OOM Killer logs.
    """
    print("--- Memory Incident Audit ---")
    
    # We use dmesg -T for human-readable timestamps
    res = subprocess.run(["dmesg"], capture_output=True, text=True)
    
    if "Out of memory: Kill process" in res.stdout:
        print("[!!!] ALERT: An OOM KILL event has occurred recently!")
        # Grab the last 3 OOM lines
        oom_lines = [l for l in res.stdout.splitlines() if "Out of memory" in l or "Killed process" in l]
        for line in oom_lines[-3:]:
            print(f"    {line}")
    else:
        print("[OK] No OOM kill events detected in dmesg.")

if __name__ == "__main__":
    check_for_oom_events()

---

7. Professional Tip: Use 'Zram' for Low-Memory VMs

If you have a tiny 512MB VPS, you shouldn't use a standard swap file (which is slow). Use Zram. It creates a compressed section of RAM that acts like swap. It is 5x faster than a disk and effectively "Doubles" your RAM through transparent compression.

---

8. Summary

Memory management is about balancing speed and survival.

• Swappiness controls the threshold for using the disk.
• free -m shows you the reality of your cache.
• OOM Killer is the final, brutal defense of the kernel.
• oom_score_adj allows you to protect your most vital services.
• Pressure (PSI) tells you before the disaster happens.

In the final lesson of this module, we move to the atomic level: Application Profiling—perf and strace.

Quiz Questions

1. Why does Linux use "Free RAM" to store disk cache, and why is this good for performance?
2. What are the consequences of setting vm.swappiness=0?
3. How can you find out which process the OOM Killer killed last night?

---

Continue to Lesson 6: Atomic Analysis—perf and strace.