Hi Winan,
One other thing. You might check to see if you have the process accounting service running. It is listed as psacct in the services GUI. Process accounting creates the file /var/account/pacct which can grow very quickly as processing acocunting records every command run within the system and the user that ran the command. If I was logged in to a system running process accounting and did a dir command, an entry in the /var/account/pacct file would be made indicating I had done a dir. Back in the old days of SCO Xenix and SCO Unix, before powerful CPUs and abundant memory, running process accounting on a busy system could actually degrade performance.
You can do a search of the web using 'Process Accounting Linux' to obtain the various command to read the /var/account/pacct file.
LelandJ