Ubuntu how to detect if OOM killer have run

Perhaps by logtail.

oom-killer leaves a trace of run in syslog and dmesg. You can put a cron job or a script to invoke via some monitoring tool that "logtails" syslog and warn you if there are lines like the one below between runs

Feb 24 13:35:29 hostname kernel: [22472693.216224] foobar:23 invoked oom-killer: gfp_mask=0x201da, order=0, oom_score_adj=0

dmesg isn't "logtailable" but dmesg -c clears the dmesg buffer after printing so the script can simply call dmesg -c | grep <string> | wc -l A value of 1 or greater means that oom-killer was invoked since the las run/boot. But this will destroy your dmesg stored info.