@cisco.13, unfortunately, I don't have one. The commands "show memory", "show memory detail", "show memory top" and sometimes "show chunkstat" are the most helpful. If you upgrade, you'll find "show chunkstat top" helpful too. Then look for something unusual, e.g. abnormally high number of memory allocations by the same pc (program counter) or for the same chunk type. Collect stats few times and check if numbers increase. Then apply common sense. Disable suspected subsystems, e.g. SNMP, and check again.
If the leak is fast, it can only be caused by some function which is invoked frequently. You mentioned VPN and SNMP in the very beginning, but the number of VPN sessions is very small, so most likely we can rule out VPN. SNMP, on the other hand, is known to cause many issues as of 9.14, including memory leaks. It's unlikely that regular firewall functions, e.g. connections or NAT can cause leaks like this, simply because corresponding code is old and pretty stable. Of course, there is always a possibility that you configured something very specific on the box, which is rarely used and hence rarely tested by dev team. So it's worth to analyze config from this angle too.
There are few other methods, but they require decoding of memory addresses, which can only be done by TAC, as we don't have symbol files. Also, exact bug is always difficult to spot, because bug descriptions created by TAC are always poorly written.
@MHM Cisco World, "NsConf" is abbreviation for Netsnmp Configuration.
