Actual process and service suspects: CPU, memory, Docker, systemd cgroups, failed services, and OOM evidence.