A Linux OOM kill on a ZFS host does not, by itself, prove that ZFS’s Adaptive Replacement Cache (ARC) caused the failure. Start by preserving the kernel report, determine whether the exhausted memory domain was the whole host or a cgroup, then correlate process, swap, and ARC measurements on the same timeline. Only after that evidence points to competition between ARC and applications should you change zfs_arc_max, adjust a service limit, or add RAM.
What a Linux OOM kill actually means
Linux invokes its out-of-memory (OOM) killer when an allocation cannot be satisfied because memory is exhausted and reclaim cannot free enough pages to continue. The failure can involve the entire machine or a constrained allocation domain such as a memory cgroup, cpuset, or memory-policy node set. The kernel’s explanation of the mechanism is that “on a loaded machine memory will be exhausted and the kernel will be unable to reclaim enough memory to continue to operate.” See the Linux kernel OOM concepts documentation.
As an Amazon Associate I earn from qualifying purchases.
The process named in the report is the victim selected by kernel heuristics within the applicable memory domain. Its name is not proof that it allocated all the memory, leaked, or caused pressure. A database, shell, or ZFS-related task can be killed because it was the most eligible victim when the kernel needed to recover memory. Linux documents the accounting and selection details in the process OOM and /proc documentation.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsAlso distinguish a kernel OOM report from an application that prints “out of memory” after its own allocator, quota, or database limit rejects a request. The latter may occur while the host still has reclaimable RAM.
#1 Best Overall
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
1. Preserve evidence before changing the host
Capture logs immediately, and do so before rebooting or changing ARC or service settings. A reboot can remove the only copy of the kernel report if persistent journaling is not enabled.
- Save the kernel journal for the boot in which the incident occurred. On a system using
systemd-journald, a representative query isjournalctl -k -b; select the previous boot with-b -1when appropriate. Export the relevant time window to a file before rotating logs. - If the journal is unavailable, inspect the kernel ring buffer with the distribution’s equivalent of
dmesg -T. Access may require root, and the buffer may have wrapped. - Copy the complete OOM block, not just the final “Killed process” line. Keep the allocation context, node or cpuset information, memory-cgroup path, selected task, and the per-process memory summary.
- Record the incident time in UTC (or include the host timezone) so process, service, and ARC samples can be aligned later.
- Do not reboot solely to make ARC “release” memory while evidence is being collected. A reboot changes the workload and erases the state you need to compare.
Command names and journal paths vary by distribution, init system, and whether logs persist across boots. Treat the commands above as examples and use the equivalents documented for your host.
2. Establish which memory domain was exhausted
Before tuning the host, decide whether the event was global or local to a service. Linux’s OOM scoring uses the memory allowed to the failing domain. Exhaustion caused by a memory limit, cpuset, memory policy, or the whole system can therefore produce similar-looking messages while requiring different fixes.
Read the OOM report for scope clues
- Look for an explicit memory-cgroup path, cgroup name, or wording that identifies a constrained group.
- Check whether the report lists a particular NUMA node, cpuset, or allocation policy rather than all system memory.
- Note the reported total, free, file-backed, anonymous, and swap figures. They describe the failing domain at that moment, not necessarily the machine’s normal state.
- Identify the selected process and its OOM adjustment, but do not equate the victim with the source of pressure.
Inspect cgroup limits and events
Find the service’s actual cgroup and inspect its configured memory limit, current usage, and OOM event counters. A cgroup can kill a process after reaching its own limit even when host-wide RAM remains available. Conversely, a host-wide OOM can affect a process that happens to run inside a cgroup.
The cited Linux memory-resource-controller documentation describes cgroup v1 interfaces, some of which are deprecated. First determine whether the host uses cgroup v1 or v2; then follow the paths and event files for that version and distribution. For v2, service managers commonly expose a directory containing memory.current, memory.max, memory.events, and related files; names and delegation may differ. For v1, inspect the controller’s memory.usage_in_bytes, memory.limit_in_bytes, and memory.failcnt where present.
Compare the domain with the whole host
At the incident time, compare the domain’s limit and usage with host RAM, swap configuration, and process totals. If only one service’s counter increments and the kernel report names that cgroup, prioritize the service’s memory budget, workload, or leak. Do not lower a host-wide ARC limit to solve a local quota unless measurements show that ARC is also consuming capacity needed outside the cgroup.
Rank #2
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
3. Measure Linux memory, processes, and swap
Take a current baseline before making changes. Save the output so a later sample can be compared rather than relying on a single interactive snapshot.
Free tools Windows power users keep installed
One-click scans. No signup required.
free -h
cat /proc/meminfo
ps -eo pid,ppid,comm,%mem,rss,vsz --sort=-rss | head -n 25
swapon --show
/proc/meminfo exposes fields such as MemTotal, MemAvailable, SwapTotal, SwapFree, AnonPages, and file-cache categories. The kernel explains these accounting fields in its /proc documentation. “Free” alone is not a pressure diagnosis: Linux normally uses otherwise idle RAM for cache, and that cache can be reclaimed.
Capture the largest processes repeatedly, especially the service that was killed. A one-time RSS value cannot distinguish a steady footprint from a short-lived spike or leak. If the service is supervised, also record its restart count and configured memory limits. Check swap size and activity; no swap, a full swap device, or a deliberately disabled swap policy can leave less reclaimable headroom, but swap availability does not prove ARC was responsible.
For longer incidents, sample /proc/meminfo, process RSS, cgroup usage, and ARC statistics at fixed intervals. Align those samples with the OOM timestamp to see which consumer grew first.
4. Check whether ARC was competing for memory
ZFS ARC is a major memory consumer on many systems, but an OOM kill alone does not establish that ARC caused it. Compare ARC size and target with application growth and the kernel’s reclaim evidence.
Read ARC statistics
OpenZFS identifies /proc/spl/kstat/zfs/arcstats as a verification source. A practical snapshot is:
Rank #3
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
grep -E '^(size|c|c_min|c_max|memory_throttle_count|shrink)' /proc/spl/kstat/zfs/arcstats
Field names can vary by OpenZFS release, so retain the complete file when investigating. The important comparison is the current ARC size (often reported as size), its target or current cap (c or c_max, depending on release), and any shrink or throttle indicators available on that build.
Current OpenZFS documentation names zarcstat for ARC monitoring; older releases commonly used arcstat. Use the tool shipped for your release and record its version. Do not infer causality from a single ARC percentage: an ARC that is large but readily reclaimable may coexist with a process leak, while a smaller ARC can still matter when applications have little headroom.
Correlate, do not guess
- If process or cgroup usage rises sharply while ARC remains near a stable target, investigate the process, service limit, or allocation pattern first.
- If ARC grows toward its target as application demand rises and the kernel reports reclaim failure, ARC may be competing for pages; verify with repeated samples.
- If the OOM is confined to a cgroup that does not account host-wide ARC pages, lowering a global ARC cap may have little effect on that cgroup’s limit.
- If the machine has multiple NUMA nodes, check whether the report describes a node-local shortage even though aggregate RAM appears sufficient.
5. Verify the OpenZFS release and ARC defaults
Never apply an old “ARC uses half of RAM” rule without checking the installed OpenZFS version. Read the package or module version using the commands supplied by your distribution (for example, its ZFS version utility and package metadata), then inspect the active module parameters.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
cat /sys/module/zfs/parameters/zfs_arc_max
cat /sys/module/zfs/parameters/zfs_arc_shrinker_limit
The exact parameter path is normally present for a loaded Linux module; if it is absent, use the distribution’s module-information tooling and configuration files. Save both the running value and the persistent setting, because a boot-time option can differ from a value changed at runtime.
| OpenZFS documentation point | What it means for troubleshooting |
|---|---|
zfs_arc_max default is zero |
A zero value derives a maximum from installed system memory rather than meaning “no limit.” |
| OpenZFS v2.3.0 and newer | The derived maximum on all platforms is the larger of total system memory minus 1 GiB and five-eighths (62.5%) of total system memory. |
| Before v2.3.0 on Linux | The documented default used half of system memory. |
| Documented lower bound | zfs_arc_max must not be set below 67,108,864 bytes (64 MiB). |
zfs_arc_shrinker_limit, v2.0–v2.2 |
Documented default: 10,000 pages made available by the ARC shrinker for one allocation attempt. |
zfs_arc_shrinker_limit, v2.3 and newer |
Documented default: zero. The parameter applies to kswapd reclaims and is a specialized control, not a general memory cap. |
These are release-specific documentation facts, not recommended settings for every server. Read the matching OpenZFS module-parameter documentation for your version before changing anything.
6. Change ARC limits carefully
What lowering zfs_arc_max does
zfs_arc_max is dynamic and sets the permitted ARC maximum. However, OpenZFS explicitly states that reducing the value below the ARC’s current size “will not cause the ARC to shrink without memory pressure to induce shrinking.” In practice, writing a lower limit does not instantly return the difference to MemAvailable. The cache must age or the kernel must apply reclaim pressure.
Rank #4
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
Make one measured change, then observe ARC size, application latency, reclaim activity, and OOM counters. A smaller ARC can reduce cache hit rates and increase disk I/O, so evaluate the workload rather than optimizing only the next free-memory reading.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Apply a temporary test, then persist only if justified
- Record the current
zfs_arc_max, ARC size, workload metrics, and cgroup limits. - Choose a conservative test value that leaves explicit headroom for the measured application set; do not substitute a generic percentage for evidence.
- Change the runtime parameter using the interface supported by your distribution (commonly the module parameter under
/sys/module/zfs/parametersor a module utility). - Generate or wait for representative workload pressure, then sample ARC and process memory at the same intervals used before the change.
- Revert if latency, cache misses, I/O wait, or application throughput deteriorates without resolving the pressure.
- If the result is beneficial, add the setting to the host’s documented module-configuration mechanism and plan a controlled reboot test; otherwise leave the temporary change out of persistent configuration.
When to consider zfs_arc_shrinker_limit
This parameter limits how many pages the ARC shrinker makes available for one allocation attempt and applies to kswapd reclaims. Because its defaults changed from 10,000 in OpenZFS 2.0–2.2 to zero in 2.3 and later, changing it without confirming the release can recreate an obsolete tuning recipe. Use it only when reclaim behavior and the version-matched documentation point to a specific problem; it is not a blanket substitute for a sensible ARC cap or an application memory limit.
7. Compare the main remedies
| Remedy | Use when evidence shows | Benefits | Risks and checks | Operational effect |
|---|---|---|---|---|
Lower zfs_arc_max |
ARC target and growth are competing with applications on the same host. | Creates a defined upper bound and can reserve more headroom for services. | Does not shrink instantly; may reduce cache hit rate and increase I/O. | Runtime change is possible; persistent configuration and reboot procedures vary by distribution. |
| Set or correct a service/cgroup limit | A single service reaches its own memory domain or has an uncontrolled leak. | Contains one workload and leaves unrelated host capacity unchanged. | A limit that is too low causes local OOM kills; inspect cgroup events and application behavior. | Usually a service-manager or container configuration change, often without reboot. |
| Fix the process or workload | RSS, anonymous memory, queues, or a known leak grows ahead of ARC. | Addresses the consuming component instead of reducing useful cache. | Requires application profiling, workload changes, or a software update. | May need a controlled restart and regression monitoring. |
| Add physical RAM | Measured demand from applications and ZFS exceeds installed capacity after software and limits are sane. | Increases headroom for both workloads and cache. | Cost, firmware limits, DIMM type, rank, speed, ECC requirements, and channel population must match the exact server or motherboard. | Normally requires downtime or a maintenance window; verify capacity after installation. |
Hardware is not the first response to an unidentified OOM. Select compatible memory only after documenting the host model, processor and chipset limits, existing DIMM configuration, firmware requirements, and the measured capacity deficit. No universal module or capacity recommendation can be made without those specifications.
8. Treat kernel OOM controls as policy, not a diagnosis
panic_on_oom can make the kernel panic instead of (or in addition to) selecting a process, depending on its configured mode. Overcommit settings change when the kernel accepts allocation commitments. These controls alter failure and recovery policy; they do not identify ARC as the cause and do not add memory.
Change them only when you have an explicit operational policy—for example, whether an appliance should reboot into a known state after a fatal memory event—and a tested recovery path. Record the current values, test in a maintenance window, and ensure monitoring will distinguish a deliberate panic policy from a hardware or kernel fault.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →9. Troubleshooting branches for common symptoms
“The killed process is always the database”
Check the OOM score adjustment, cgroup scope, and per-process growth. The database may simply be the largest eligible victim. Compare its RSS and anonymous-memory trend with ARC size and other services before changing ZFS.
Best Value
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
“ARC is close to the cap, so it must be the cause”
A high ARC target shows cache occupancy, not causality. Look for simultaneous process growth, reclaim failures, and the memory domain named by the kernel. A cache at its target can still be reclaimable; a lower target can still leave an application leak untouched.
“I lowered zfs_arc_max, but free memory did not increase”
This is expected when current ARC exceeds the new limit and the system has not experienced reclaim pressure. Verify the running parameter, then observe ARC size during representative activity. Do not repeatedly lower the value without measuring cache performance and application headroom.
“The host has free RAM, but a container was OOM-killed”
Inspect that container’s cgroup limit and event counters. A local limit can be exhausted while host-wide MemAvailable remains substantial. Tune the container or service budget first unless host evidence also shows global pressure.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11“The OOM appeared after a kernel or OpenZFS upgrade”
Record the new kernel and OpenZFS versions, then compare active parameter values with the release-specific defaults. In particular, the documented ARC calculation changed in OpenZFS 2.3, and the documented zfs_arc_shrinker_limit default changed as well. Re-evaluate old module options rather than carrying them forward blindly.
10. Validate the fix and prevent recurrence
- Keep a before-and-after record containing kernel OOM logs, cgroup limits and events, process RSS, swap state, ARC size and target, OpenZFS version, and module parameters.
- Replay a representative workload or observe a full production cycle. A quiet host can hide the pressure that triggers failure.
- Watch application latency, throughput, cache-hit behavior, I/O wait, swap activity, and restart counts—not just free memory.
- Alert on cgroup OOM events and host OOM-kill messages separately so a local quota breach is not mistaken for global exhaustion.
- Document every runtime and persistent setting, including why it was chosen and the conditions that should trigger rollback.
- Recheck after kernel, OpenZFS, service-manager, container-runtime, or hardware changes because defaults and memory accounting can change.
A defensible conclusion identifies the exhausted domain, the consumers that grew during the event, the ARC state at the same time, and the measured effect of one change. If those elements are missing, label the cause unconfirmed instead of attributing the kill to ZFS by default.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
