The site is upload really slow

Need help to find out why the site is running really slow.

now it is giving the "PLease Wait" about 15 second when it used to login  just on 3 second.

Even logout taking about 9 second. plus  it is also slowest on "Profile page"

The server log look okay to me : Please help....

System information

Server load	1.14 (8 CPUs)
Memory Used	17.69% (2,883,532 of 16,303,816)
Swap Used	5.96% (500,192 of 8,388,600)

Disk information

Device	Mount point	Usage
/tmp	/var/tmp	4% (71,332 of 2,064,208)
/dev/sdb1	/backup	0% (551,576 of 961,432,904)
/dev/sda3	/tmp	4% (71,332 of 2,064,208)
/dev/sda1	/boot	25% (59,455 of 247,919)
/dev/sda5	/	28% (252,820,164 of 950,858,788)

I can take a look at it if you still need help with it... 

Check your database tables. You might have fragmentation or just a lot of members.

The memory used by your system is not really relevant since the memory available for MySQL is a fixed number, meaning that MySQL can be using its max allowed memory while the overall memory has plenty available. The most common issue is the available memory for joins. Joins can create a large dataset and if there is not enough memory (for MySQL) your server will start caching. Not sure how bussy your server is, but that could explain the CPU load of 1.

Swap Used	5.96% (500,192 of 8,388,600)

If swap is already used, then you was running out of memory some time ago. Try to run this command via SSH terminal:

sudo swapoff -a; sudo swapon -a;

It should clear your swap and move everything from it to the main memory. If this will help, then it's a problem with memory overload, probably some non-optimized scripts.

 check the load on your database, 

(robot) adds thousands of spam on your site?

Would be also useful to see your actual site URL, so we can check load time from different countries and try to figure out what's going on. 

A swap file is alway present and does not mean that the system ran out of memory. The OS or program running can decide that data with a lower priory is written to cache, rather then storing it in memory. Clearing your swap file in that case will not make a difference.

If the site was hit by (spam) bots the CPU load most likely would have been a lot higher then it is now and I'm sure he would have seen spam messages appear on the site.

Checking from different parts of the world to see if that makes a difference doesn't seem very usefull either since that would only indicate bottlenecks on the internet outside of his controll.

Check your MySQL logs and look for things like slow running queries. I'm sure that it will give you clues.

Also, the Dolphin cache file can corrupt or be very large, causing some delays. Have you ever cleared your cache to see if that had any effect? It's a wild guess but can be worth it, if you do not find any other clues.

 There are no adds at all on the site. NO spam account

I contacted my host Provider this is what they told me they found.. But the sites still running slow. Before all of these happening the apps were acting funny by logout members and take up to 20 second to log in about 5 days ago.

This is from my host Provider:

"The load on your server looks good as does the memory usage. I noticed over 2000 processes called "./cpl -d" running by the root user since the 18th. I do not know what that was but scripts run by root usually use the full path and not a "./" path. I found that file in the directory /root/.ssh/.../spz9_1. That ... directory should not be there. The files may have been put there on Jan 12th judging by the time stamp. The subdirectories have email lists. Should any one from Germany be logging into your server as root? The logs show access on January 11th from the IP 87.118.122.184. There was also logins from an IP owned by GoDaddy on Saturday when that script was started.

I also saw your mail queue has 1515 emails in the queue some are 160 days old.

 Yes I cleared  cache but that did not help.

 Well, if that doesn't ring (alarm) bells...

 Have you tried to access your site from another computer/internet connection? Sometimes I can't open my site on US hosting here in Europe, but it works perfect for US users.

When you see "Please wait" message for 15 seconds, what message do you see in status bar?

 As Denre points out, your server is under attack and being used to send spam mail from one account maybe two.

just thought i would post an update for anyone following...

System information

 Is it faster in any way? What about server and database adjustments? How many people are online at the same time?

What I'm interested in is to know what those processes were and those directories with email addresses, etc.

How did they get there?

 This is the Right Question!