Thanks all for your suggestions and advice.
we used the below query which gave us visibility of sql being processed
SELECT s.sid, s.username, s.uid, s.pid, s.hostname, t.tid,t.name, t.statedesc, t.statedetail, q.sqs_statement, t.cpu_time
FROM syssessions s, systcblst t, sysrstcb r, syssqlstat q
WHERE t.tid = r.tid AND s.sid = r.sid AND s.sid = q.sqs_sessionid
ORDER BY t.cpu_time desc;
From this we determined that the same SQL was present across almost all Informix CPUs at any point in time - this SQL was related to an application function for stock descriptions and it is frequently called by several hundred users throughout the day. With so many users calling this function it was then spread across almost all Informix assigned CPUs. We then determined a table that was supposed to be self clearing, but had it's record size grow in excess of 1M rows (possibly due to growing abandoned sessions before this incident). We think the query on this table was taking too long and hence becoming a bottleneck with a backlog of transactions waiting - hence high CPU across all CPUs. Truncating the table and clearing out abandoned sessions helped bring it back under control. We now need to discuss with the application developers and put in place some mitigations to avoid for future.
just sharing the outcome of this incident in case its helpful for someone else in future.
Again, many thanks for the advise and counsel.
Cheers, Mark
------------------------------
Mark Clayton
------------------------------