I will suggest a different approach I would probably use if I had to deal with such a request right now.
I would probably not rely on LUA and NAS to ensure this, because it's a bit complex for that need and you lose a bit in reliability (because several components and communications channels are going to be used). I would instead create a small script in whatever language I need to:
- get the amount of free memory (to replace the feature already present in CDM),
-immediately after that show up in the stdout the top X processes consuming the more memory in case the threshold is breached, and 0 in case it's not.
You can then use the logmon probe (aka "the probe which does everything other probes cannot do") and run that script on a scheduled basis. Using the logmon features, you capture the output and do a regex catch on this: if it's 0 no alarm, and if you have anything else, alarm with the output. You can therefore generate an alarm with the top 5 memory-consuming processes whenever your memory threshold is breached!
That doesn't prevent you to open a "formal" idea with adding the feature you'd like to have directly into the CDM probe. It might be considered by product management and be added in a further release