Diagnosing memory leaks in a long-running legacy Java service

[SavannahKM]

I'm maintaining a legacy Java application that's been running in production for years, and we've recently started experiencing gradual performance degradation and eventual crashes in our long-running services, which strongly points to a memory leak. I've taken heap dumps and used profiling tools, but the sheer size and complexity of the old codebase makes it difficult to pinpoint the root cause among countless cached objects, static collections, and third-party libraries. For developers who have successfully hunted down elusive memory leaks in similar environments, what was your step-by-step diagnostic process after getting a heap dump? Are there specific patterns or common culprits in enterprise Java applications I should investigate first, and what tools or techniques proved most effective for isolating the leaking objects and tracing them back to the source code, especially when the leak might be in a library we don't control?