Conflicting Load Alerts Mask Memory Exhaustion on Linux Web Server

Impact Summary

Diagnose a Linux web server reporting high load averages but low CPU usage. Identify memory exhaustion and swap thrashing as the root cause, validate with vmstat and free, and safely recover by restarting the leaking service.

SeveritySEV-2

StatusResolved simulation

PlatformOperating Systems

Incident TypeOperating Systems

Published30 Aug 2026

Technologies Involved

Linux

Simulation Label

Fictional simulation. This exercise is a bounded, invented training scenario for practising operational reasoning. No real organisation, incident, telemetry, credentials or production identifiers are involved or implied.

Operational Summary

Root Cause

Memory exhaustion in the Python application caused excessive swap usage, leading to thrashing and high load averages despite low CPU utilisation.

Detection Method

Evidence-led guided investigation

Current Status

Resolved simulation

Affected Services

Linux

Incident Overview

You are on-call for a production Linux web server running Nginx and a Python application. Monitoring alerts trigger for high load average (load > 10 on a 4-core system), yet CPU utilisation remains below 15%.

Users report intermittent 504 Gateway Timeouts. The system has 16GB RAM and 4GB swap.

Investigation Options

Review the available operational moves and select the best immediate action.

Restart the Nginx service to clear connection queues.

Identify and restart the memory-leaking Python application process.

Add more swap space to accommodate the current memory demand.

Scale up the instance CPU cores to handle the high load average.

Tags:Linux

Related Incident Reports

Operating Systems