We should also create cluster metric that will be collected by Telemetry, since the customer can't fix the issue.
Use the RSS metric instead of working_st_bytes for calculating the diff.

For example something like:
cnv_abnormal{reason=memory_request_exceeded, component=kubevirt, container=virt_api}
cnv_abnormal{reason=memory_request_exceeded, component=kubevirt, container=virt_handler} 

and the value can be the amount of bytes that exceeded the request.