How can you catch a process that overloads the server?

Question

linux

The problem arose on the VPS. It has three sites with very little traffic (on average, less than 300 hits per day per site). But yesterday I received a letter from the hoster that the server is very overloaded and that they had to turn it off because it interferes with the work of other KVM VPS. I looked at the load using sar and saw the following:

00:30:01            3       275      0.73      0.88      0.83
00:40:02            1       271      1.67      1.21      1.00
00:50:02            0       259      0.62      1.20      1.17
01:00:01            0       259      0.40      0.62      0.89
01:10:01            0       261      0.54      0.80      0.91
01:20:01            0       259      0.98      0.76      0.79
01:30:01            1       261      0.54      0.68      0.75
01:40:01            2       260      0.45      0.68      0.72
01:50:01            0       259      0.66      0.63      0.67
02:00:01            0       255      0.23      0.37      0.52
02:10:01            0       259      0.60      0.59      0.58
02:20:01            0       259      0.31      0.42      0.50
02:30:01            0       259      0.84      0.51      0.49
02:40:01            1       259      0.25      0.39      0.46
02:50:23            0       612    121.36     52.51     20.27
03:00:38           22       732    270.99    232.67    133.25

After that, the server automatically restarted (probably, this was done by the hosting supervisor). I did not find any reasons for such a high load - everything is as usual in Apache logs, nothing unusual in messages either - they periodically try to brute force the server, but not more than usual. I have a question for experienced admins: how to monitor and catch a process that can overload a server so much?

Answer 1

Put atop in logging mode - I think that it will become clear who is blunting.