[BUG] oom-killer invoked and crash instances

[GiovanniGit-IT]

What happened?

Hello, i have a bug with a oom-killer invoked and crash nginx, crowdsec, etc ...

Config :
Bunkerweb Linux
Debian12
4 CPU
16 Go RAM
Ram used : 7,9/16

How to reproduce?

Classic configuration with ~50 services

Configuration file(s) (yaml or .env)

Relevant log output

/var/log/kern.log:2026-03-11T10:09:03.635244+01:00 XXXXXXXXXX kernel: [1632353.205841] crowdsec invoked oom-killer: gfp_mask=0x140cca(GFP_HIGHUSER_MOVABLE|__GFP_COMP), order=0, oom_score_adj=0
/var/log/kern.log:2026-03-11T10:09:03.883522+01:00 XXXXXXXXXX kernel: [1632353.206745] oom-kill:constraint=CONSTRAINT_NONE,nodemask=(null),cpuset=/,mems_allowed=0,global_oom,task_memcg=/system.slice/bunkerweb.service,task=nginx,pid=2602157,uid=999
/var/log/kern.log:2026-03-11T10:09:06.568448+01:00 XXXXXXXXXX kernel: [1632356.190161] nginx invoked oom-killer: gfp_mask=0x140cca(GFP_HIGHUSER_MOVABLE|__GFP_COMP), order=0, oom_score_adj=0
/var/log/kern.log:2026-03-11T10:09:06.635515+01:00 XXXXXXXXXX kernel: [1632356.190435] oom-kill:constraint=CONSTRAINT_NONE,nodemask=(null),cpuset=/,mems_allowed=0,global_oom,task_memcg=/system.slice/bunkerweb.service,task=nginx,pid=2602158,uid=999
/var/log/kern.log:2026-03-11T10:09:07.568417+01:00 XXXXXXXXXX kernel: [1632357.124383] auditd invoked oom-killer: gfp_mask=0x140cca(GFP_HIGHUSER_MOVABLE|__GFP_COMP), order=0, oom_score_adj=-1000
/var/log/kern.log:2026-03-11T10:09:07.570246+01:00 XXXXXXXXXX kernel: [1632357.124619] oom-kill:constraint=CONSTRAINT_NONE,nodemask=(null),cpuset=/,mems_allowed=0,global_oom,task_memcg=/system.slice/bunkerweb.service,task=nginx,pid=2602159,uid=999
/var/log/kern.log:2026-03-11T10:09:08.412842+01:00 XXXXXXXXXX kernel: [1632358.038236] python3.11 invoked oom-killer: gfp_mask=0x140cca(GFP_HIGHUSER_MOVABLE|__GFP_COMP), order=0, oom_score_adj=0
/var/log/kern.log:2026-03-11T10:09:08.415647+01:00 XXXXXXXXXX kernel: [1632358.038460] oom-kill:constraint=CONSTRAINT_NONE,nodemask=(null),cpuset=/,mems_allowed=0,global_oom,task_memcg=/system.slice/bunkerweb.service,task=nginx,pid=2602160,uid=999
/var/log/syslog:2026-03-11T10:09:03.635244+01:00 XXXXXXXXXX kernel: [1632353.205841] crowdsec invoked oom-killer: gfp_mask=0x140cca(GFP_HIGHUSER_MOVABLE|__GFP_COMP), order=0, oom_score_adj=0
/var/log/syslog:2026-03-11T10:09:03.883522+01:00 XXXXXXXXXX kernel: [1632353.206745] oom-kill:constraint=CONSTRAINT_NONE,nodemask=(null),cpuset=/,mems_allowed=0,global_oom,task_memcg=/system.slice/bunkerweb.service,task=nginx,pid=2602157,uid=999
/var/log/syslog:2026-03-11T10:09:06.568448+01:00 XXXXXXXXXX kernel: [1632356.190161] nginx invoked oom-killer: gfp_mask=0x140cca(GFP_HIGHUSER_MOVABLE|__GFP_COMP), order=0, oom_score_adj=0
/var/log/syslog:2026-03-11T10:09:06.635515+01:00 XXXXXXXXXX kernel: [1632356.190435] oom-kill:constraint=CONSTRAINT_NONE,nodemask=(null),cpuset=/,mems_allowed=0,global_oom,task_memcg=/system.slice/bunkerweb.service,task=nginx,pid=2602158,uid=999
/var/log/syslog:2026-03-11T10:09:07.568417+01:00 XXXXXXXXXX kernel: [1632357.124383] auditd invoked oom-killer: gfp_mask=0x140cca(GFP_HIGHUSER_MOVABLE|__GFP_COMP), order=0, oom_score_adj=-1000
/var/log/syslog:2026-03-11T10:09:07.570246+01:00 XXXXXXXXXX kernel: [1632357.124619] oom-kill:constraint=CONSTRAINT_NONE,nodemask=(null),cpuset=/,mems_allowed=0,global_oom,task_memcg=/system.slice/bunkerweb.service,task=nginx,pid=2602159,uid=999
/var/log/syslog:2026-03-11T10:09:08.412842+01:00 XXXXXXXXXX kernel: [1632358.038236] python3.11 invoked oom-killer: gfp_mask=0x140cca(GFP_HIGHUSER_MOVABLE|__GFP_COMP), order=0, oom_score_adj=0
/var/log/syslog:2026-03-11T10:09:08.415647+01:00 XXXXXXXXXX kernel: [1632358.038460] oom-kill:constraint=CONSTRAINT_NONE,nodemask=(null),cpuset=/,mems_allowed=0,global_oom,task_memcg=/system.slice/bunkerweb.service,task=nginx,pid=2602160,uid=999

BunkerWeb version

1.6.8

What integration are you using?

Linux

Linux distribution (if applicable)

Debian 12

Removed private data

• I have removed all private data from the configuration file and the logs

Code of Conduct

• I agree to follow this project's Code of Conduct

[mkf-sysangels]

Do you have a swap-file defined on your host?

Maybe this would help for the first moment:

Example for creating a 16GB swapfile on /

fallocate -l 16G /swapfile
chmod 600 /swapfile
mkswap /swapfile >/dev/null 2>&1
swapon /swapfile
if ! grep -q "/swapfile" /etc/fstab 2>/dev/null; then
	echo "/swapfile none swap sw 0 0" >> /etc/fstab
fi

[GiovanniGit-IT]

Hello, thanks for answer

I already have a swap file for 2,1go and 150mo used actually

[mkf-sysangels]

Is this related to that report? #3154

[GiovanniGit-IT]

No, ModSec is ok and i don't have alert/report about modsec at time of crash with oom-killer.

[rrrevin]

Could be this: #3057
Also note, I did this and it dropped ram used drastically : #3190

[GiovanniGit-IT]

Mmmh i'm not concerned by this because i don't have fail2ban or multiple workers in production.
Juste a AIO bunkerweb.

but thanks :D