You may find the atop package useful for this. It's like a recording version of top or htop. After something has happened you can look back at the loads, resources and processes around that time. I wrote a post with a couple of common commands and a link to a detailed guide.