Hello,
the exec command 'show proc mem' should give you an indication which process is using up the memory.
The link below is a good start for troubleshooting:
Memory Troubleshooting Guide for Cisco 4000 Series ISRs
http://www.cisco.com/c/en/us/td/docs/routers/access/4400/troubleshooting/memorytroubleshooting/isr4000_mem.html
That said, there is a bug which displays the wrong values for CLI generated free/used memory values. Do you experience any performance issues If not, check if the bug below applies:
Free memory in show command in IOS-XE fixed to show accurate value
CSCva29067
Description
Symptom:
The CLIs that display the Free Memory and Used Memory data will show accurate values after this fix
Conditions:
N/A
Workaround:
N/A
Further Problem Description:
The following CLI outputs will display the accurate value of the ?Free Memory? and ?Used Memory? in the system. This update will be available in Denali 16.3.1 and later releases.
1. show memory platform
a. show memory platform information
2. show processes memory platform
a. show processes memory platform location <...>
b. show processes memory platform sorted
c. show processes memory platform sorted location <..>
3. show platform software status control-processor
4. show platform software status control-processor brief
5. show platform software process list switch active R0 summary
6. show platform resources
