Rstatd allows remote queries for many system load related parameters by applications such as rup and rsysinfo.
This SonicWALL signature identifies legitimate Rstatd traffic.