I would ssh into the machine and run commands like top, lsof and ps to try to figure out what is running and what files are being used.