When a Linux system has been running for a while without reboot, and the more it keeps allocating and de-allocating pages, the quicker the memory becomes fragmented. And the kernel may not always be able to defragment enough memory for a requested size on time. During (Intrusion Prevention) IPS Scanning, if the system was not able to allocate a continuous memory, the agent will send the Insufficent memory alert and not be able to scan the network traffic. 

Workaround:

 
To create a scheduled job to do Linux memory defragmentation. The following is the memory defragmentation command: 
 

echo 3 > /proc/sys/vm/drop_caches
echo 1 > /proc/sys/vm/compact_memory