In addition to the "show ip route summary" that Flavio requested, providing the "threshold_lowmem_info_20241020-174038-gmt" that was generated would be helpful as well. This is a special crashinfo file that gets generated in a low memory scenario, and it will help us get a better understanding of what process is holding a significant amount of memory, which led to the memory allocation (MALLOC) failures (MALLOCFAIL) seen in the snippet of logs you provided.
If the switches are receiving more routes than they can handle, that would explain the memory exhaustion and subsequent crash.
The following are also good commands to collect on a live box to check the memory status at the current moment in time:
show clock
show version
show platform software status control-processor brief
show processes memory sorted
! Checks IOSd memory utilization
show processes memory platform sorted
! Checks kernel memory utilization
The threshold_lowmem_info file along with any crash-related files (crashinfo, core.gz, system-reports, etc.) are your best bet for getting confirmation.
