Greetings Wayne,
There was one leak (in SocketCommunicationsInterface) to our knowledge that was introduced in 9.2.0 and fixed in 9.2.1 and that's why I asked. But since you are in 9.2.1, then forget it.
I don't think SDF would be much of a help here. But what happens when you get the "failed to allocate more memory"? Does it just exits the VM? Do you have any walkback or vmtrp to share?
Using EsMemoryUseReport could be a good idea. I am CCing Adriaan, which is a customer of ours, that as far as I know they were recently hunting a leak and they have a kind of watchdog process that would dump the info of EsMemoryUseReport every X time. You may try that as well.
The other question is how reproducible is this. You said "in one environment"...so that means that it happens only in that environment but not in others? How frequently does that scenario happen?
Best,
Mariano