In Security Analytics 10.5.1, we are facing high memory utilization in ESA. Even if I disable all the deployed rules, the free memory available in ESA is around 40% of overall memory.
Not sure where the memory is being utilized.
Before disabling the rules:
free -g -->
total used free shared buffers cached
Mem: 94 94 0 0 0 12
-/+ buffers/cache: 81 13
Swap: 7 4 3
After disabling all the rules:
free -g -->
total used free shared buffers cached
Mem: 94 55 39 0 0 17
-/+ buffers/cache: 38 56
Swap: 7 0 7
Can you check the processes using your memory by using top command and then confirm