---
title: OOM Kill
description: Track process OOM kills by the system or cgroup.
breadcrumbs: Docs > Integrations > OOM Kill
---

> For the complete documentation index, see [llms.txt](https://docs.datadoghq.com/llms.txt).

# OOM Kill
Supported OS Integration version1.0.0
{% callout %}
# Important note for users on the following Datadog sites: us2.ddog-gov.com

{% alert level="info" %}
To find out if this integration is available in your organization, see your [Datadog Integrations](https://app.datadoghq.com/integrations) page or ask your organization administrator.

To initiate an exception request to enable this integration for your organization, email [support@ddog-gov.com](mailto:support@ddog-gov.com).
{% /alert %}

{% /callout %}

## Overview{% #overview %}

This check monitors the kernel OOM (out of memory) kill process through the Datadog Agent and the System Probe.

## Setup{% #setup %}

### Installation{% #installation %}

The OOM Kill check is included in the [Datadog Agent](https://app.datadoghq.com/account/settings/agent/latest) package. It relies on an eBPF program implemented in the System Probe.

The eBPF program used by the System Probe is compiled at runtime and requires you to have access to the proper kernel headers.

On Host and Docker installations, install the kernel headers:

- Debian-like distributions:
  ```sh
  apt install -y linux-headers-$(uname -r)
  ```
- RHEL-like distributions:
  ```sh
  yum install -y kernel-headers-$(uname -r)
  yum install -y kernel-devel-$(uname -r)
  ```

**Note**: Kernel version 4.9 or later is required for the OOM Kill check to work. In addition, Windows and CentOS/RHEL versions earlier than 8 are not supported.

### Configuration{% #configuration %}

{% tab title="Host" %}
#### Host{% #host %}

1. In the `system-probe.yaml` file at the root of your Agent's configuration directory, add the following configuration:

   ```yaml
   system_probe_config:
     enable_oom_kill: true
   ```

1. The Agent has a pre-packaged [`oom_kill.d/conf.yaml.default`](https://github.com/DataDog/datadog-agent/blob/main/cmd/agent/dist/conf.d/oom_kill.d/conf.yaml.default) file that is used when the check is enabled in the `system-probe.yaml`. This is in the `conf.d/` folder at the root of your Agent's configuration directory. You can create a custom `oom_kill.d/conf.yaml` file to change the configuration options.

1. [Restart the Agent](https://docs.datadoghq.com/agent/guide/agent-commands.md#start-stop-and-restart-the-agent).

{% /tab %}

{% tab title="Docker" %}
#### Docker{% #docker %}

1. Start the Agent container with the environment variable to enable the check in the System Probe process. This uses the pre-packaged [`oom_kill.d/conf.yaml.default`](https://github.com/DataDog/datadog-agent/blob/main/cmd/agent/dist/conf.d/oom_kill.d/conf.yaml.default) once enabled:

   ```
   -e DD_SYSTEM_PROBE_CONFIG_ENABLE_OOM_KILL=true
   ```

1. Mount the following volumes to the Agent container:

   ```
   -v /sys/kernel/debug:/sys/kernel/debug
   -v /lib/modules:/lib/modules
   -v /usr/src:/usr/src
   ```

1. Add the following permission to enable BPF operations:

   ```
   --privileged
   ```

From kernel version 5.8, the `--privileged` parameter can be replaced by `--cap-add CAP_BPF`.

**Note**: `--privileged` mode is not supported in Docker swarm.
{% /tab %}

{% tab title="Kubernetes" %}
#### Kubernetes{% #kubernetes %}

##### Datadog Operator{% #datadog-operator %}

Set the `features.oomKill.enabled` parameter in the `DatadogAgent` manifest:

```yaml
apiVersion: datadoghq.com/v2alpha1
kind: DatadogAgent
metadata:
  name: datadog
spec:
  #(...)
  features:
    oomKill:
      enabled: true
```

**Note**: When using COS (Container Optimized OS), override the `src` volume in the node Agent:

```yaml
apiVersion: datadoghq.com/v2alpha1
kind: DatadogAgent
metadata:
  name: datadog
spec:
  #(...)
  features:
    oomKill:
      enabled: true
  override:
    nodeAgent:
      volumes:
      - emptyDir: {}
        name: src
```

##### Helm{% #helm %}

With the [Datadog Helm chart](https://github.com/DataDog/helm-charts), set the following configuration in your `values.yaml` file:

```yaml
datadog:
  #(...)
  systemProbe:
    enableOOMKill: true
```

With these settings, the `system-probe` container is automatically deployed with the required configuration and permissions.
{% /tab %}

### Validation{% #validation %}

[Run the Agent's status subcommand](https://docs.datadoghq.com/agent/guide/agent-commands.md#agent-status-and-information) and look for `oom_kill` under the `Collector` section.

## Data Collected{% #data-collected %}

### Metrics{% #metrics %}

|  |
|  |
| **oom_kill.oom_process.count**(count) | The count of processes OOM killed*Shown as process* |

### Service Checks{% #service-checks %}

The OOM Kill check does not include any service checks.

### Events{% #events %}

The OOM Kill check submits an event for each OOM Kill that includes the killed process ID and name, as well as the triggering process ID and name.

## Troubleshooting{% #troubleshooting %}

Need help? Contact [Datadog support](https://docs.datadoghq.com/help/).