Thanks, but why is the tallying the only thing that uses the complete disk io?
Some kind off "turnarround/breakpoint" component when logs/logging and/or mailboxes grows to large, then this kind of tasks are to busy with themselves. (a kind of vicious circle i try to explain this behavouir right??? )
SSD DISKS?
Try to pin down on a USER when its only one.
( then his/her/it Mailboxes and logging behaviour sometimes User LOGS in a kind of debug modus ( and or have very much errors in webapps) much to much, don;t know or these kind of LOGS are in tally also??)
Wrong config settings also gave huge logs, for example https <> not https problems after switching Site to https some cCMS still have hard pointing to non https links. in DB somewhere... loggings are oft done for that "errors " to
I'm not sure wich logs files are all in taly but such kind of changes could be cause of bigger log files ( or much more activity there). (looping or not correct non http to https links/rewrites and so on)
Ofcourse some Yokers do abuse log files for DDOS and such kind of "FUN"
If problem is there and you do this
https://help.directadmin.com/item.php?id=402 you see some....
You could (login as that user) and see / look for large log files and or mailboxes. if its no system/brute force logs
DISK-IO dataskq tally tuning >
https://help.directadmin.com/item.php?id=525
If the tally is using up too much disk I/O, you can slow down the dataskq using the ionice binary, if you have it.
is in util-linux
https://en.wikipedia.org/wiki/Util-linux