no free/cached memory and no process consuming it

Question

I can't manage to monitor where my RAM is hidden, it's not buff/cached and I'm not sure to understand the /proc/meminfo data

What is sure is when I top or try to catch processes I can't find more than 3-4 processes that consume 0.1% of my RAM

I tried to reboot the server, it goes right for few hours and then within seconds the memory drops from 90% free to this

Here are my free -m and /proc/meminfo

Thanks in advance

$free -m
              total        used        free      shared  buff/cache   available
Mem:           3924        3569         205           5         150         160
Swap:           512         133         379

$cat /proc/meminfo 
MemTotal:        4019180 kB
MemFree:          217848 kB
MemAvailable:     168264 kB
Buffers:           13024 kB
Cached:           106532 kB
SwapCached:        21440 kB
Active:           109704 kB
Inactive:          53776 kB
Active(anon):      19084 kB
Inactive(anon):    30604 kB
Active(file):      90620 kB
Inactive(file):    23172 kB
Unevictable:           0 kB
Mlocked:               0 kB
SwapTotal:        525308 kB
SwapFree:         388992 kB
Dirty:                76 kB
Writeback:             0 kB
AnonPages:         25476 kB
Mapped:            17148 kB
Shmem:              5756 kB
Slab:              49972 kB
SReclaimable:      26380 kB
SUnreclaim:        23592 kB
KernelStack:        3484 kB
PageTables:         5576 kB
NFS_Unstable:          0 kB
Bounce:                0 kB
WritebackTmp:          0 kB
CommitLimit:      771568 kB
Committed_AS:     404024 kB
VmallocTotal:   34359738367 kB
VmallocUsed:           0 kB
VmallocChunk:          0 kB
HardwareCorrupted:     0 kB
AnonHugePages:         0 kB
ShmemHugePages:        0 kB
ShmemPmdMapped:        0 kB
HugePages_Total:    1722
HugePages_Free:     1722
HugePages_Rsvd:        0
HugePages_Surp:        0
Hugepagesize:       2048 kB
DirectMap4k:       13248 kB
DirectMap2M:     4163584 kB

$df -h | grep tmpfs
udev           devtmpfs  2.0G     0  2.0G   0% /dev
tmpfs          tmpfs     393M   46M  347M  12% /run
tmpfs          tmpfs     2.0G   48K  2.0G   1% /dev/shm
tmpfs          tmpfs     5.0M   48K  5.0M   1% /run/lock
tmpfs          tmpfs     2.0G     0  2.0G   0% /sys/fs/cgroup

$ipcs -m

------ Shared Memory Segments --------
key        shmid      owner      perms      bytes      nattch     status      
0x00000000 0          zabbix     600        576        6          dest         
0x00000000 32769      zabbix     600        365056     6          dest    

To provide more information, this is a backup storage server, since 4 days now, when we received the warning about ram, the backups fail to transfer to it. The veeam error is : "Error: Socket has been forcibly closed. Failed to recover connection."

rkhunter didn't find anything but :

[10:07:58] Info: Starting test name 'os_specific'
[10:07:58] Performing Linux specific checks
[10:07:58]   Checking loaded kernel modules                  [ Warning ]
[10:07:58] Warning: The modules file '/proc/modules' is missing.
[10:07:58] Info: Using modules pathname of '/lib/modules'
[10:07:58]   Checking kernel module names                    [ Warning ]
[10:07:59] Warning: The kernel modules directory '/lib/modules' is missing or empty.
[10:08:26] Performing filesystem checks
[10:08:26] Info: SCAN_MODE_DEV set to 'THOROUGH'
[10:08:59]   Checking /dev for suspicious file types         [ Warning ]
[10:08:59] Warning: Suspicious file types found in /dev:
[10:08:59]          /dev/shm/wx: ELF 64-bit LSB executable, x86-64, version 1 (GNU/Linux), statically linked, stripped