highAdvancedUSE#memory#overcommit#malloc#mmap#limits

Cannot allocate memory — malloc fails despite free RAM

Application fails with Cannot allocate memory

Likely source:availabilityperformance

Focused incident mode — strips away everything but this runbook.

Symptoms

  • Application fails with Cannot allocate memory
  • free -h shows plenty of available RAM
  • dmesg shows Out of memory or process killed by oom-killer

Memory overcommit is a common cause of Cannot allocate memory on production databases and Elasticsearch clusters. Always verify overcommit_memory before assuming the hardware is at fault.

Evidence to grab

Collect these artifacts before you change anything — they prove (or rule out) each cause.

  • Overcommit settings

    cat /proc/sys/vm/overcommit_memory && cat /proc/sys/vm/overcommit_ratio

  • Memory map limits

    cat /proc/sys/vm/max_map_count

Diagnostic flow

Run the steps in order, marking each claim confirmed or refuted. The evidence you gather feeds the ranked causes below.

Guided decision tree is ready.

Steps with commands, expected output, and pass/fail branches.

Ranked root causes

Evidence checklist

  • overcommit_memory is set to 2
  • Committed_AS exceeds CommitLimit in /proc/meminfo
  • Application fails to mmap large regions

Confirm before fixing

grep -E 'Commit|CommitLimit' /proc/meminfo
READ

Compare committed memory against the hard limit

Fix

sysctl -w vm.overcommit_memory=0
CHANGE

Switch to heuristic overcommit (allows reasonable overcommit)

Resolution runbook

Apply from top to bottom after the cause is confirmed. Review every command before running it — risk tags are shown on each.

1
cat /proc/sys/vm/overcommit_memory && cat /proc/sys/vm/overcommit_ratio
READ

Check the overcommit policy

2
grep -E 'Commit|CommitLimit' /proc/meminfo
READ

Check if committed memory exceeds the limit

3
cat /proc/sys/vm/max_map_count
READ

Check memory map limits

4
sysctl -w vm.overcommit_memory=0 && sysctl -w vm.max_map_count=262144
CHANGE

Relax the overcommit and mmap limits

Prevention

  • Set vm.overcommit_memory=0 on most systems; use mode 2 only with careful CommitLimit tuning.
  • Tune vm.max_map_count for mmap-heavy applications like Elasticsearch.
  • Set ulimit -v and ulimit -d explicitly in service unit files.
  • Alert on /proc/meminfo CommitLimit approaching.

Related runbooks

Same stack, same failure family — worth a skim.

Cgroup OOM kill — process killed by kernel out-of-memorycritical

dmesg shows Out of memory: Killed process <PID>

LinuxIntermediateUSE3 causes
Open runbook
Memory pressure — kswapd high, swap active, system thrashinghigh

System is sluggish and unresponsive under load

LinuxIntermediateUSE2 causes
Open runbook

Commands marked READ CHANGE DESTRUCTIVE — never run DESTRUCTIVE commands against production data you cannot restore. Copy → verify → execute.