If this is running over NFS you should be able to use tcpdump to trace
out the NFS operations. Use a UDP mount to make the tracing work more
easily.
tcpdump -i <interface> -s 4096 -v port 2049
And see if you can localize the operations related to the problem.
-Matt
