Who killed the process: reading the OOM log

A service vanished overnight. systemctl status said only killed, and the application log was clean. Check the kernel first:

dmesg -T | grep -i -E 'oom|killed process'
journalctl -k --since '1 day ago' | grep -i oom

A line like Out of memory: Killed process 1234 (java) names the process, PID and RSS. The kernel did it, not the application.

You can contain it with MemoryMax= or protect a critical process with oom_score_adj, but the real question is why memory grew. smem -t -k and /proc/<pid>/smaps_rollup tell you whether it is heap or page cache.