From the MRTG data I can see that suddenly on a currently not very
busy machine the load averege went over 15 or more. This happened
around 10 in the morning. Not many entries in httpd access log, smtp
server was not too much loaded (at that time it generally produces a
load average of about 1).
By any chance, do you run SpamAssassin? I have seen load average bursts with
SA. It seems to me that spam sites are bursting spam to attempt to bring
down the anti-spam filters.
As mentioned by others a "ps" (or I prefer "pstree") list will help
solve the issue.
Thanks. I do have SA but I studied the logs carefully and no outside
connections, except for one with a vary small message desitined for
mailman subscription arrived at around that time.
Is it possible that there's a message in your queue that's *being
processed*, so it may have arrived earlier than near that time and
causes the spike?
What tests is SA running? Or something with your DNS settings that is
holding up SA while trying to look something up?