When a Linux system has been running for a while without reboot, and the more it keeps allocating and de-allocating pages, the quicker the memory becomes fragmented. And the kernel may not always be able to defragment enough memory for a requested size on time. During (Intrusion Prevention) IPS Scanning, if the system was not able to allocate a continuous memory, the agent will send the Insufficent memory alert and not be able to scan the network traffic.
Workaround:
To create a scheduled job to do Linux memory defragmentation. The following is the memory defragmentation command:
echo 3 > /proc/sys/vm/drop_caches echo 1 > /proc/sys/vm/compact_memory