Redis full? Fix "OOM command not allowed" and vanishing sessions with maxmemory

The two settings

• maxmemory: how much memory Redis may use. On Debian it's 0 by default, which means no limit. Redis then grows until the whole server runs out of memory, and Linux starts killing programs (see out-of-memory errors).
• maxmemory-policy: what Redis does when it reaches the limit. The default is noeviction: refuse new data.

See the current values and how full Redis is:

redis-cli config get maxmemory
redis-cli config get maxmemory-policy
redis-cli info memory | grep -E "^(used_memory_human|maxmemory_human)"
redis-cli info stats | grep evicted_keys

If Redis has a password (it should, see securing Redis), add --askpass or -a to each command.

What each policy did in our test

noeviction (the default): once the limit was reached, every write failed:

OOM command not allowed when used memory > 'maxmemory'.

PHP got the same message as a RedisException, so the page failed unless the code caught it. Reads still worked, and so did deleting keys. Nothing was thrown away. That's what you want for data you can't lose, but you have to make sure it never fills up.

allkeys-lru: Redis threw away the least recently used keys to make room, without any error. In our test it removed about 2,000 old cache keys. A key we had just read stayed. That's the right choice for a cache, where anything can be rebuilt.

volatile-lru, the trap: it only throws away keys that have an expiry time. We stored 800 sessions (which expire after a day) and then queued jobs (which don't expire). Redis deleted all 800 sessions, so every user was logged out. When nothing with an expiry time was left, the queued jobs failed anyway with "OOM command not allowed". So you lose the sessions and still get the error.

Pick the policy by what Redis holds

• Only cache (page cache, object cache, Laravel's cache): allkeys-lru, with a maxmemory that fits your server.
• Sessions or queued jobs: noeviction, and enough memory, plus a warning before it fills up. Losing these means logged-out users or lost jobs (orders, emails).
• Both in one Redis: don't. The policy is set for the whole Redis server, not per database number, so SELECT 1 for the cache doesn't separate them. Run a second Redis for the cache, or move sessions to the database.

Set it for good

redis-cli config set changes the running Redis only. In our test, redis.conf was unchanged afterwards, so the setting would be gone after a restart. Put it in /etc/redis/redis.conf:

maxmemory 256mb
maxmemory-policy allkeys-lru

Then restart Redis: sudo systemctl restart redis-server. On a small server that also runs PHP and a database, a few hundred MB is usually plenty for a cache. Check what's free with free -m.

A second Redis for the cache: Debian's package includes a redis-server@ service that reads /etc/redis/redis-NAME.conf. Copy redis.conf to /etc/redis/redis-cache.conf and give it its own port (for example 6380), pidfile /run/redis-cache/redis-server.pid, logfile, dbfilename and the cache policy, then sudo systemctl enable --now redis-server@cache. We checked that the service file exists, but didn't run a second instance under systemd for this guide.

Already full? Get out of the error

• If it's only cache, clearing it is safe: redis-cli flushdb (the current database) or your app's own command, such as php artisan cache:clear. Deleting worked in our test even when Redis was full.
• If it holds sessions or jobs, don't flush. Raise maxmemory for now (redis-cli config set maxmemory 512mb, if the server has the memory), then find out what's filling it. redis-cli --bigkeys shows the biggest keys.

Quick list

• OOM command not allowed: Redis is at maxmemory with noeviction. Clear cache, raise the limit, or change the policy.
• Users logged out, keys vanish: an eviction policy is throwing data away. info stats | grep evicted_keys.
• Cache only: allkeys-lru. Sessions and queues: noeviction with room to spare.
• Avoid volatile-lru with sessions and jobs in the same Redis.
• Make it last: put the settings in redis.conf. config set is lost on restart.

Official sources

• Redis: key eviction (maxmemory and every policy)
• Redis: configuration

Next steps: lock Redis down with securing Redis, and if users are logged out without Redis in the picture, see PHP sessions and Debian's cleanup.

ServerNest is being built to set up Redis with safe limits and warn you before it fills up. Join early access to try it first.

← Back to the security blog