criticalIntermediateUSE#fork#process#pid#limits#ulimit

Fork bomb — runaway process count exhausting PIDs

Cannot fork or Cannot allocate memory when trying to start new processes

Likely source:availabilityscaling

Focused incident mode — strips away everything but this runbook.

Symptoms

  • Cannot fork or Cannot allocate memory when trying to start new processes
  • Process count climbs rapidly (ps -e | wc -l keeps increasing)
  • System becomes completely unresponsive

Evidence to grab

Collect these artifacts before you change anything — they prove (or rule out) each cause.

  • Total process count

    ps -e | wc -l

  • PID limit

    cat /proc/sys/kernel/pid_max

Diagnostic flow

Run the steps in order, marking each claim confirmed or refuted. The evidence you gather feeds the ranked causes below.

Guided decision tree is ready.

Steps with commands, expected output, and pass/fail branches.

Ranked root causes

Evidence checklist

  • One parent PID has spawned thousands of identical children
  • ps -eo ppid shows one PID dominating

Confirm before fixing

ps -eo ppid --sort=ppid | uniq -c | sort -rn | head -5
READ

Identify the parent PID with the most children

Fix

kill -9 -<PGID>
DESTRUCTIVE

Kill the entire process group of the fork bomb parent

Resolution runbook

Apply from top to bottom after the cause is confirmed. Review every command before running it — risk tags are shown on each.

1
ps -e | wc -l
READ

Confirm the process count is near the limit

2
ps -eo ppid --sort=ppid | uniq -c | sort -rn | head -5
READ

Find the parent with the most children

3
kill -9 -<PGID>
DESTRUCTIVE

Kill the offending process group

4
ps -e | wc -l
READ

Verify process count has dropped

Prevention

  • Set ulimit -u (max user processes) to a sane limit in /etc/security/limits.conf.
  • Add LimitNPROC= to systemd unit files for each service.
  • Restrict who can run fork bombs with pam_limits.
  • Monitor process count per user and alert before the limit is reached.

Related runbooks

Same stack, same failure family — worth a skim.

Zombie processes accumulating — orphaned children not reapedmedium

ps shows processes with Z state (zombie)

LinuxIntermediateUSE2 causes
Open runbook
Fork: Cannot allocate memory — max user processes exceededhigh

fork: Cannot allocate memory even though free RAM is available

LinuxIntermediateUSE3 causes
Open runbook

Commands marked READ CHANGE DESTRUCTIVE — never run DESTRUCTIVE commands against production data you cannot restore. Copy → verify → execute.