This service goes offline due to the current usage memory of correlation-server is above Fatal Threshold. There could be ESA rules which are consuming high memory.
Please follow the below steps to check rules with high memory consumption.
Login to UI and Navigate to Configure->ESA Rules->Services.
For Each deployment, sort the rules based on ‘Memory Usage’. Check if there are any rules consuming 100 MB or more. Also, look for any rules skipping Memory metrics. Such rules will have a red exclamatory symbol in the ‘Memory Usage’ column.
Again sort the rules based on ‘CPU’. Check if there are any rules consuming 40% or more.look for any rules skipping CPU metrics. Such rules will have a red exclamatory symbol in ‘CPU’ column.
Please disable such rules in Step 2 and Step 3 and monitor the memory and cpu usage of the correlation server as below.