AWS systems-manager documentation change
Summary
Added troubleshooting section for patching failures due to out of memory (OOM) errors, including causes and solutions.
Security assessment
This change addresses a performance/resource issue (insufficient memory during patching) rather than a security vulnerability. It provides operational guidance to mitigate OOM errors but does not indicate a security flaw or add security-specific documentation.
Diff
diff --git a/systems-manager/latest/userguide/patch-manager-troubleshooting.md b/systems-manager/latest/userguide/patch-manager-troubleshooting.md index 611a72113..0037c354e 100644 --- a//systems-manager/latest/userguide/patch-manager-troubleshooting.md +++ b//systems-manager/latest/userguide/patch-manager-troubleshooting.md @@ -131,0 +132,2 @@ When a `Scan` operation runs, it overwrites the compliance details from the most + * Issue: Patching fails with an out of memory (OOM) error + @@ -323,0 +326,30 @@ A common example occurs with the `urllib3` package, which is found in `pip`, `yu +### Issue: Patching fails with an out of memory (OOM) error + +**Problem** : When you run `AWS-RunPatchBaseline`, the patching operation fails due to insufficient memory on the managed node. You might see errors such as `Cannot allocate memory`, `Killed` (from the Linux OOM killer), or the operation fails unexpectedly. This error is more likely to occur on instances with less than 1 GB of RAM, but can also affect instances with more memory when a large number of updates are available. + +**Cause** : Patch Manager runs patching operations using the native package manager on the managed node. The memory required during a patching operation depends on several factors, including: + + * The number of packages installed and available updates on the managed node. + + * The package manager in use and its memory characteristics. + + * Other processes running on the managed node at the time of the patching operation. + + + + +Managed nodes with a large number of installed packages or a large number of available updates require more memory during patching operations. When available memory is insufficient, the patching process will fail and exit with an error. The operating system can also terminate the patching process. + +**Solution** : Try one or more of the following: + + * Schedule patching operations during periods of low workload activity on the managed node, such as by using maintenance windows. + + * Upgrade the instance to a type with more memory. + + * Configure swap memory on the managed node. Note that on instances with limited EBS throughput, heavy swap usage may cause performance degradation. + + * Review and reduce the number of processes running on the managed node during patching operations. + + + +