I know I did this the hard way, I'd like to see how you guys would approach the situation. 130 domains on your webserver, normal load of .50-.90 during the day. You're watching top and all of a sudden you see tons of apache processes/requests jump up that fill your whole screen, and mysql starts using 48% of the CPU. Load goes up to 12.. How would you track the problem user?

Enable server-status

As long as the load is temporary, i dont think its a huge problem, when our servers parse their logs each night and run webalizer stats, the load goes up to over 60 on some machines (dual 1ghz with 1.5g ram atleast! - that is some load) - granted the server becomes unavailable for 2 minutes to new connection but it goes down

if you user /server-status it should give you an idea of the domain thats causing the problem.

We also use something called bwbar which will update an html page every X seconds with the current output of the server, so we go into the problem site, make a .htaccess to deny access to everyone and watch the bwbar to see if the output goes back to normal, if it doesnt, it's a differnet site.

Hope this helps.