legitimate high-volume production workloads processing multiple concurrent requests, users loading large language models (7b+ parameters) that naturally require substantial memory allocation, simultaneous multi-model deployments during system scaling, batch processing operations, or initial system startup sequences may generate similar memory allocation patterns during normal operations.

splunk

Techniques

Sample rules

Ollama Possible Memory Exhaustion Resource Abuse

source: splunk
technicques:

Description

Identifies high Ollama runner counts and large model buffer allocations as possible resource pressure indicators. Memory values vary with model size and hardware, and these operational logs do not establish malicious intent; validate against host capacity and workload baselines.

Detection logic

`ollama_server`
("*llama_kv_cache*" OR "*compute buffer*" OR "*llama runner started*" OR "*loaded runners*")


| rex field=_raw "count=(?<runner_count>\d+)"

| rex field=_raw "(?<memory_mb>[\d\.]+)\s+MiB"

| rex field=_raw "started in\s*(?<load_time>[\d\.]+)\s*seconds"

| rex field=_raw "source=(?<code_source>[^\s]+)"


| bin _time span=5m


| stats count as operations
        avg(load_time) as avg_load_time
        avg(memory_mb) as avg_memory
        dc(code_source) as unique_sources
        max(load_time) as max_load_time
        max(memory_mb) as max_memory
        max(runner_count) as peak_loaded_runners
        values(code_source) as code_sources
  by _time host


| where operations > 10 OR peak_loaded_runners > 5 OR max_memory > 400


| eval avg_memory=round(avg_memory, 2)

| eval max_memory=round(max_memory, 2)

| eval avg_load_time=round(avg_load_time, 2)

| eval max_load_time=round(max_load_time, 2)

| eval severity=case(peak_loaded_runners > 10, "critical", peak_loaded_runners > 5 OR operations > 20, "high", max_memory > 400 OR operations > 10, "medium", 1=1, "low")

| eval attack_type="Resource Pressure / Memory Allocation"


| table _time host operations peak_loaded_runners
        unique_sources avg_memory max_memory
        avg_load_time max_load_time severity attack_type


| `ollama_possible_memory_exhaustion_resource_abuse_filter`