earlyoom - Early Out-of-Memory Daemon Cheatsheet

earlyoom - Early Out-of-Memory Daemon Cheatsheet

earlyoom is a lightweight userspace daemon that prevents the classic Linux “the whole system froze when it ran out of RAM” problem. When memory runs low, the in-kernel OOM killer often reacts too late, after the machine has already become unresponsive from thrashing. earlyoom monitors available RAM and swap and, when they drop below configurable thresholds, kills the largest memory consumer early — keeping the system interactive instead of hanging. It is simple, dependency-free, and widely used on desktops and servers.

Installation

Platform	Command
Debian/Ubuntu	sudo apt install earlyoom
Fedora	sudo dnf install earlyoom (default on Fedora Workstation)
Arch Linux	sudo pacman -S earlyoom
From source	make && sudo make install from the repo
Verify	earlyoom --version

Enabling the Service

Command	Description
sudo systemctl enable --now earlyoom	Enable and start the daemon
sudo systemctl status earlyoom	Check it is running
journalctl -u earlyoom -f	Watch its decisions live
earlyoom	Run in the foreground (testing)

How It Decides

earlyoom watches two numbers and acts when both fall below their thresholds:

Metric	Flag	Default-ish
Free RAM %	-m PERCENT	e.g. 10%
Free swap %	-s PERCENT	e.g. 10%
Kill trigger	both below thresholds	—

# Kill when RAM < 5% AND swap < 5%
earlyoom -m 5 -s 5

Key Options

Option	Description
-m PERCENT[,KILL]	RAM threshold to warn/kill (two values = warn,kill)
-s PERCENT[,KILL]	Swap threshold to warn/kill
-M SIZE	RAM threshold in KiB instead of percent
-r INTERVAL	Memory report interval (seconds)
-n	Enable desktop notifications on kill
-N COMMAND	Run a command on kill (e.g. custom alert)
--prefer REGEX	Prefer killing processes matching a name
--avoid REGEX	Avoid killing processes matching a name
-p	Give earlyoom itself a favorable OOM score
-d	Enable debug output

Preferring / Avoiding Processes

# Prefer killing browsers/compilers; protect the display server and sshd
earlyoom -m 8 -s 8 \
  --prefer '(^|/)(chrome|firefox|cc1plus|java)$' \
  --avoid '(^|/)(Xorg|sshd|systemd)$'

Directive	Effect
--prefer	Kill these first when possible
--avoid	Kill these only as a last resort

Tuning these keeps a runaway process from taking your session or SSH access with it.

Configuration File

On systemd distros, options usually live in an env file:

# /etc/default/earlyoom  (Debian) or the unit's EnvironmentFile
EARLYOOM_ARGS="-m 5 -s 5 -r 60 --avoid '(^|/)(sshd|Xorg)$'"

Then sudo systemctl restart earlyoom.

earlyoom vs systemd-oomd vs kernel OOM

Aspect	earlyoom	systemd-oomd	Kernel OOM killer
Layer	Userspace daemon	Userspace (systemd, PSI-based)	Kernel
Trigger	Free RAM/swap %	Pressure Stall Info (PSI)	Truly out of memory (late)
Granularity	Process (biggest)	cgroup/unit	Process
Config	Simple flags	systemd oomd policy	Limited (oom_score_adj)
Best for	Simple, effective safety net	systemd-managed cgroups	Last resort

On modern systemd distros, systemd-oomd (PSI-based) is an alternative; earlyoom remains popular for its simplicity and works anywhere.

Common Workflows

# Desktop: keep the UI responsive, notify on kills, protect the session
earlyoom -m 8 -s 4 -n --avoid '(^|/)(Xorg|gnome-shell|sshd)$'

# Server: conservative thresholds, log every action
sudo systemctl enable --now earlyoom
journalctl -u earlyoom -f

Resources

• GitHub Repository
• README / Options
• Linux OOM killer background