How would you approach investigating a memory leak in production?