I would try to find out the load spike of memory utilization in the Servers before 2-3 hours ago., As the alerts are being triggering out by the altering system. I try to find out the utilization via the sar command, but how come I know which user and command is consuming more of memory utilization by the time.
If the server is not actually under load, you will find it difficult to determine what user was working and what command that they were using. Trying to find what was happening "2-3 hours ago." will be better accomplished by looking at the "alerting system" logs.
Thanks for your update..
Later I am thinking like if the ram utilization is less than 300M and the load average is more then 4.00 , should take all the top users of memory and CPU utilization through "top" and "ps " command and put under one path.