most likely someone is abusing some script on your server. Try the following script to run each minute as cronjob:
Code:
* * * * * /path/to/script.sh
and the script...
Code:
#!/bin/sh
mkdir -p /var/log/script
date=`date +%H_%M`
/etc/init.d/httpd fullstatus > /var/log/script/apache_status_$date
top -b -n 1 > /var/log/script/top_$date
netstat -anp > /var/log/script/netstat_$date
ps -efww > /var/log/script/ps_$date
free > /var/log/script/free_$date
w > /var/log/script/w_$date
You will need to enable ExtendedStatus and mod_status in apache with the /server-status location so you can get each minute's apache status.
After the server is dead and back online you will have a lot of info to look at. Check the active connections, processes, pids, compare with the apache status, etc
java socket