The hdparm can tell you if DMA is enabled and what IO of your
disk reads and disk cache is.........
with x being your drive....a ,b ,c ......etc

There is a chance I suppose you've been "rooted". Things you can do to find out -

See if there is a .rhosts file created in your /root directory with a "+ +" entry. This is a bad sign.
Have a look in your /etc/passwd and /etc/shadow files for strange logons.
Download, install and run a "check rootkit".
Think about using some sort of intrusion detection, like tripwire or snort in future.
Do a "netstat -pln" and suss out the processes that are listening.

Check the security section of these forums, do some searches. If you've been hacked and it's causing a slowdown the hacker must be using your box for something and it won't be hard finding out what that is.

Check your space too, maybe you have huge logs that are pinching space and making fragmentation. Anyway, best of luck with your server and post the result when you get to the bottom of things

#hdparm -Tt /dev/hda

/dev/hda:
Timing buffer-cache reads: 892 MB in 2.01 seconds = 444.44 MB/sec
Timing buffered disk reads: 112 MB in 3.01 seconds = 37.26 MB/sec

There is a nobody account in both passwd and shadow.

I already have the psad (IDS) and the builtin suse firewall well-configured.

port 111 is laways open.

Well that disk is pretty fast ! I wouldn't worry about that then.

Having a "nobody" user is normal, nothing to worry about. The 111 is a "remote procedure call" service and is used in NFS, perhaps also for other things. I'm no expert at all on this but perhaps someone is using a remote mount attack on you ? It's a long guess. If you're really worried you should take it to the security forum - where the guys really know what they're talking about.

how can i see the cpu in Mhz?