Linux之OOM-killer

查看哪个进程被杀死：　grep -i ‘killed process’ /var/log/messages 或者 dmesg | grep -i ‘killed process’

dmesg vs /var/log/messages

　　两者都是用于记录系统消息的，dmesg是内存缓存的消息，超过大小会丢弃，所以要及时查看；messages里是syslog-ng写进去的，写的内容依赖于其配置/etc/syslog-ng/conf.d，持久化到文件；

total-vm、anon-rss和file-rss含义：

total-vm：进程总共使用的虚拟内存；

anon-rss：虚拟内存实际占用的物理内存；

file-rss：虚拟内存实际占用的磁盘空间；

　　As I understand, the size of the virtual memory that a process uses is listed as “total-vm”. Part of it is really mapped into the RAM itself (allocated and used). This is “RSS”. Part of the RSS is allocated in real memory blocks (other than mapped into a file or device). This is anonymous memory (“anon-rss”) and there is also RSS memory blocks that are mapped into devices and files (“file-rss”).

　　 So, if you open a huge file in vim, the file-rss would be high, on the other side, if you malloc() a lot of memory and really use it, your anon-rss would be high also. On the other side, if you allocate a lot of space (with malloc()), but nevers use it, the total-vm would be higher, but no real memory would be used (due to the memory overcommit), so, the rss values would be low.

查看操作用户：

　　首先根据dmesg找出占用非法内存的进程，然后找出启动该进程的UID，执行grep UID /etc/password找出该用户；