[ ] Show running processes to figure out when a program started
USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND
nobody 17859 2.2 0.2 8076 2452 ? S Jan13 91:42 /usr/sbin/apache/logins
- Note the time that the file was run and how long. Notice in my example it shows: Jan13 91:42. That's 91 minutes and 42 seconds ago from the time you ran top.
You can use that time to start digging through /usr/local/apache/domlogs
[ ] Check your mail logs to see if somebody is sending out a large quantity of emails.