Nick, thanks for the article - I just read it, and have read many others like it. They usually point to some sort of resource problems (not enough cpu power, not enough ram, etc.) and how to tune dansguardain to work within those limited resources. The server I'm running is overkill to the extreme for this software, and always has resources to spare - never swaps, is running cacheless, etc.

It worked fine over the weekend (which is not unusual, it seems to work fine for 24-72hrs.) I checked on the processes this morning and they were fine, 900 or so (with 200-500 of those being used by dansguardian.) and then bam, around 9AM, it went to 1672 (dansguardian using 1003) and internet was functionally dead until I reset the web proxy cache (which it shouldn't be using any of.)

If it IS a particular problem user (malware, bit torrent, etc.) how do I find the offending IP/device? I can navigate the web interface and run any command I like easily while the processes are stuck - I just don't know where to look...

Here is the output to the command you asked me to run:

[root@mensdorm ~]# lspci -k | grep Eth -A 3
01:00.0 Ethernet controller: Broadcom Corporation NetXtreme II BCM5709 Gigabit Ethernet (rev 20)
Subsystem: Dell PowerEdge R610 BCM5709 Gigabit Ethernet
Kernel driver in use: bnx2
Kernel modules: bnx2
01:00.1 Ethernet controller: Broadcom Corporation NetXtreme II BCM5709 Gigabit Ethernet (rev 20)
Subsystem: Dell PowerEdge R610 BCM5709 Gigabit Ethernet
Kernel driver in use: bnx2
Kernel modules: bnx2
02:00.0 Ethernet controller: Broadcom Corporation NetXtreme II BCM5709 Gigabit Ethernet (rev 20)
Subsystem: Dell PowerEdge R610 BCM5709 Gigabit Ethernet
Kernel driver in use: bnx2
Kernel modules: bnx2
02:00.1 Ethernet controller: Broadcom Corporation NetXtreme II BCM5709 Gigabit Ethernet (rev 20)
Subsystem: Dell PowerEdge R610 BCM5709 Gigabit Ethernet
Kernel driver in use: bnx2
Kernel modules: bnx2
03:00.0 SCSI storage controller: LSI Logic / Symbios Logic SAS1068E PCI-Express Fusion-MPT SAS (rev 08)

Also, I changed those two other mistake posts, so you can delete them if you like - I only set them to private so everyone wouldn't have to see them. thanks!