

This will enable process accounting (if not already added). The second way to look for this is to enable process accounting.

There is a problem with this, primarily if the box goes into a runaway cpu loop and produces huge load - your not guaranteed that your actual process will execute in a timely manner during load (if at all) so you could actually miss the output! I would suggest this be your first port of call since it produces the most valuable/reliable data to work with. This will give you a quite detailed outlook of the running of the system at ten minute intervals. pidstat -u 600 >/var/log/pidstats.log & disown $! The first way is to setup pidstat to run in the background and produce data. Note that its entirely possible its many processes in a runaway scenario causing this, not just one. There are a couple of possible ways you can do this.
