Alerting on an unexpectedly high rate-of-change, as some others have suggested, also seems good for some workloads.