Hyperping's server agent records used, available, and total memory, with utilization as a percentage, every 30 seconds. A memory leak shows up as available memory sliding down over hours or days, well before the host runs out.
On Linux the used figure on its own is close to useless, because the kernel deliberately fills spare RAM with page cache: file data kept in memory that can be reclaimed the moment a process needs it. A perfectly healthy server can sit at 95% used forever and never be short of anything.
The number to watch and alert on is available (MemAvailable in /proc/meminfo), the kernel's estimate of how much memory a new allocation can get without swapping or reclaiming aggressively. Available memory sliding down over hours is the shape of a leak. A single dip is usually a large file being read.
Memory problems end abruptly rather than gradually. When the host runs out, the kernel's OOM killer terminates the process using the most memory, which is often your application or database, and it disappears without any slow rise in response time first. An external uptime check often catches it only after users do. The early warning is the trend in available memory, days before.
The used percentage doesn't matter much on Linux. Keep available memory above 10 to 15% of total, and watch that it stays flat over days rather than sliding down.
Free memory isn't used for anything, not even cache, and is usually small on a healthy server. Available memory is free memory plus cache that can be reclaimed, which is what new processes can actually use.
Run free -h and read the available column. ps aux --sort=-rss | head lists the processes using the most. See how to monitor memory usage on Linux.