How can I check what ate all the memory?

In the 15 min stat:
Memory utilization 7349.38 MB/7544.00 MB (97%)

nothing else is written which could help me. It sometimes wrote that 1
or 2 correlation rule use high memory (which was good untill this and
not edited) and even If I turn it off, still bad.
What should I check or where should I start to troubleshoot?

I checked server0.0.log, server_wrapper.log, disk space, iostat, top.
Sentinel 7.2.1

Thank you for your help!

woodspeed's Profile: https://forums.netiq.com/member.php?userid=7232
View this thread: https://forums.netiq.com/showthread.php?t=52082