Linux Survival Basics
Read-only, can be slowSpot OOM Kills in the Kernel Journal
A worker exited during an incident and you need to check whether the kernel killed it for memory pressure.
Command
journalctl -k --since "2 hours ago" --no-pager -o short-iso | grep -Ei 'out of memory|oom|killed process'Before you run this
System impact: Read-only. Can create load on large logs, directories, filesystems, or process tables.
When not to use it: Do not use it as a full memory diagnosis; follow up with memory, swap, cgroup, and process checks.
Expected output
Kernel journal lines mentioning out-of-memory or killed processes.
System impact
Read-only, can be slow. Nothing changes. The command filters kernel journal lines for OOM evidence.
Scope this to the smallest useful path or service on busy systems.
Recovery / rollback: no state is changed.
When to use it
Use when services exit with code 137, restart suddenly, or disappear under memory pressure.
When not to use it
Do not use it as a full memory diagnosis; follow up with memory, swap, cgroup, and process checks.
next steps
Related commands
Find OOM Killer Lines in the Kernel Journal
Before restarting a service, prove whether the kernel killed it.
journalctl -k --since '24 hours ago' --no-pager | grep -iE 'out of memory|oom-killer|killed process'
Read Recent systemd Timer Logs
Timer logs show whether systemd attempted to trigger the task.
journalctl -u backup.timer --since "24 hours ago" --no-pager
Group Journal Errors by Unit
A noisy incident usually has a noisy source.
journalctl -p err..alert --since "2 hours ago" --no-pager -o short-iso | awk '{split($3,a,"["); unit=a[1]; count[unit]++} END {for (u in count) print count[u], u}' | sort -nr
Read Recent Logrotate Journal
The journal can show why rotation skipped.
journalctl -u logrotate --since '7 days ago' --no-pager
Summarize Journal Severity During an Incident
Start with severity counts before opening every log line.
journalctl -p warning..alert --since "2 hours ago" --no-pager -o short-iso | awk '{count[$4]++} END {for (level in count) print count[level], level}' | sort -nr
Study mapping
Use this as independent command practice: read the notes, predict the output, then compare it with the example before using a real shell.
Independent study support only. No affiliation, endorsement, exam dumps, or real exam questions.