Top memory processes - capture/logged - Best practices

I have some odd memory usage going on with one of my servers. Among other things, we monitor memory usage.

At 2 am and again at 4 am we are seeing free memory drop within the alert threshold range. I am capturing the amount of memory available and sar -r gives all I need and more about the numbers, but I am looking for the best way to capture the associated processes.

I have considered using accounting but concerned with the overhead it brings.
Also, I have checked cron and we don't have anything scheduled on any account during that time frame.

Thoughts, suggestions....

Thanks.