Servers, applications, interface utilization spikes.
I gave some example SQL code in this thread:
Re: Help... how can I alert on a sharp change in the WAN Utilization?
No reason that couldn't be modified around to look at memory. Premise is to look at utilization for the last hour/day then compare it to the average of the last week / month. If there is a delta greater than "x" - throw an alert. Pretty low system load, because if you are looking at the last hour vs. last week, no need to run the monitor more than hourly.