you can get statistics off cgroups to get idea what it was (assuming it's a service and not something user ran), but that requires probing it often enough