该怎么查找问题

rainytooo

最近两天 每天下午4点左右服务器就无法连接
半个小时后恢复正常
系统上主要跑了apache oracle mysql resin

iptables设置
##################################
top iptables service first
/sbin/service iptables stop

# Load FTP Kernel modules
/sbin/modprobe ip_conntrack_ftp
/sbin/modprobe ip_nat_ftp

# Inital chains default policy
/sbin/iptables -F -t filter
/sbin/iptables -P INPUT DROP
/sbin/iptables -P OUTPUT ACCEPT

# Enable Native Network Transfer
/sbin/iptables -A INPUT -i lo -j ACCEPT

# Accept Established Connections
/sbin/iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT

# ICMP Control
/sbin/iptables -A INPUT -p icmp -m limit --limit 1/s --limit-burst 10 -j ACCEPT

# WWW Service
/sbin/iptables -A INPUT -p tcp --dport 80 -j ACCEPT

# FTP Service
/sbin/iptables -A INPUT -p tcp --dport 21 -j ACCEPT

# SSH
/sbin/iptables -A INPUT -p tcp --dport 22222 -j ACCEPT

# MYSQL
#/sbin/iptables -A INPUT -p tcp --dport 3306 -j ACCEPT

# RESIN
#/sbin/iptables -A INPUT -p tcp --dport 12202 -j ACCEPT

# ORACLE
#/sbin/iptables -A INPUT -p tcp --dport 1521 -j ACCEPT
##################################


没有其他用户登陆过
没有关机重启过
# cat /var/log/messages

Aug 10 04:06:50 xiaoma syslogd 1.4.1: restart.
Aug 12 20:17:07 xiaoma kernel: Removing netfilter NETLINK layer.
Aug 12 20:17:07 xiaoma kernel: Netfilter messages via NETLINK v0.30.
Aug 12 20:17:07 xiaoma kernel: ip_conntrack version 2.4 (8192 buckets, 65536 max) - 228 bytes per conntrack
Aug 12 20:17:07 xiaoma kernel: ip_tables: (C) 2000-2006 Netfilter Core Team
Aug 12 21:50:51 xiaoma kernel: Removing netfilter NETLINK layer.
Aug 12 21:50:51 xiaoma kernel: Netfilter messages via NETLINK v0.30.
Aug 12 21:50:51 xiaoma kernel: ip_conntrack version 2.4 (8192 buckets, 65536 max) - 228 bytes per conntrack
Aug 12 21:50:51 xiaoma kernel: ip_tables: (C) 2000-2006 Netfilter Core Team
Aug 12 23:02:28 xiaoma kernel: Kernel logging (proc) stopped.
Aug 12 23:02:28 xiaoma kernel: Kernel log daemon terminating.
Aug 12 23:02:29 xiaoma exiting on signal 15
Aug 12 23:02:29 xiaoma syslogd 1.4.1: restart.
Aug 12 23:02:29 xiaoma kernel: klogd 1.4.1, log source = /proc/kmsg started.

看了apache的access和error都是在那个时间段基本没有访问了

我该怎么查找问题呢
# cat /etc/syslog.conf
###################################
# Log all kernel messages to the console.
# Logging much else clutters up the screen.
#kern.*                                                 /dev/console

# Log anything (except mail) of level info or higher.
# Don't log private authentication messages!
*.info;mail.none;authpriv.none;cron.none                /var/log/messages

# The authpriv file has restricted access.
authpriv.*                                              /var/log/secure

# Log all the mail messages in one place.
mail.*                                                  -/var/log/maillog


# Log cron stuff
cron.*                                                  /var/log/cron

# Everybody gets emergency messages
*.emerg                                                 *

# Save news errors of level crit and higher in a special file.
uucp,news.crit                                          /var/log/spooler

# Save boot messages also to boot.log
local7.*                                                /var/log/boot.log

###################################


系统是RHEL5
2.6.18-8.el5xen #1 SMP Fri Jan 26 14:42:21 EST 2007 i686 i686 i386 GNU/Linux