INCIDENT 2026-08-15 07:28:18 trigger: php_rss=2730MB mysql_conn=20 ================================================================== load: 2.56 11.18 12.93 31/635 2564232 ncpu:10 mem_avail: 7243MB/11729MB (61.8%) swap_used:1504MB swapout:0/s blocked(D):0 running:23 iowait:1.1% steal:0.0% php: 19 procs / 2730MB heaviest user: madalice (18 procs, 2591MB) apache: 53 procs tcp_estab: 62 --- RSS by user (all processes) --- USER PROCS RSS_MB madalice 18 2719 nobody 53 797 mysql 1 513 root 243 333 netdata 8 222 speedlin 1 139 wp-toolkit 6 17 mailman 20 17 dovenull 6 17 cpanellogin 1 17 zabbix 1 12 vinesit 1 12 kurri 2 12 dovecot 3 6 dbus 1 3 evolution 4 2 polkitd 1 1 nscd 1 1 named 1 1 mailnull 1 1 --- php workers by user --- USER PROCS RSS_MB madalice 18 2746 speedlin 1 140 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 3486 MB Active(file): 1296 MB Inactive(file): 811 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 201 MB CommitLimit: 9960 MB Committed_AS: 10476 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 2342983 root 06:17:03 120 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2561012 1 mysql 525936 3.7 Ssl 04:48 /usr/sbin/mariadbd 2564143 2563802 madalice 245388 58.0 R 00:04 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2564145 2563803 madalice 240640 69.0 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2564148 2563962 madalice 203584 61.0 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2564154 2564132 madalice 202144 90.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2564156 2564152 madalice 200404 98.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2564147 2563963 madalice 195512 58.6 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2564150 2564135 madalice 184748 57.3 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2564155 2564137 madalice 179004 83.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1220 1 netdata 172616 2.5 Ssl 46-21:18:21 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 2564162 2563956 madalice 168808 71.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2564151 2564134 madalice 159040 46.6 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2564153 2564136 madalice 154220 70.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2564157 2563896 madalice 153376 69.0 S 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2564112 2564109 speedlin 145396 23.8 S 00:06 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2564159 2563967 madalice 143028 61.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2564178 2562295 madalice 112560 83.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2564158 2563964 madalice 103956 35.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2564161 2562240 madalice 98476 32.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2564160 2563961 madalice 98448 33.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2564170 2564110 madalice 82560 44.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2382613 1 root 66184 0.0 Ss 05:05:07 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 2390233 2382613 root 62476 0.0 S 04:52:41 spamd child 4922 2431 netdata 37344 0.1 Sl 46-21:18:16 /usr/libexec/netdata/plugins.d/go.d.plugin 1 2564165 1463 root 22404 3.5 S 00:02 tailwatchd - chkservd - named check 2562240 1276780 nobody 20904 0.0 S 03:08 /usr/sbin/httpd -k start 2562280 1276780 nobody 20744 0.0 S 03:04 /usr/sbin/httpd -k start 1353308 1 root 20308 0.0 Ss 24-04:46:51 cpsrvd (SSL) - waiting for connections 2563802 1276780 nobody 19912 0.1 S 00:35 /usr/sbin/httpd -k start 2562295 1276780 nobody 18912 0.0 S 03:03 /usr/sbin/httpd -k start 2563809 1276780 nobody 18892 0.1 S 00:33 /usr/sbin/httpd -k start 2564179 2563966 nobody 18616 3.0 R 00:01 /usr/local/cpanel/cgi-sys/autodiscover.cgi 2563796 1276780 nobody 18612 0.1 S 00:36 /usr/sbin/httpd -k start 2563924 1276780 nobody 18536 0.1 S 00:20 /usr/sbin/httpd -k start 2563956 1276780 nobody 18492 0.1 S 00:19 /usr/sbin/httpd -k start 2563954 1276780 nobody 18452 0.1 S 00:19 /usr/sbin/httpd -k start 2563880 1276780 nobody 18400 0.0 S 00:26 /usr/sbin/httpd -k start 2563925 1276780 nobody 18344 0.1 S 00:20 /usr/sbin/httpd -k start 2564125 1276780 nobody 17964 0.0 S 00:05 /usr/sbin/httpd -k start 2562294 1276780 nobody 17932 0.0 S 03:03 /usr/sbin/httpd -k start 2563803 1276780 nobody 17812 0.1 S 00:35 /usr/sbin/httpd -k start 2563964 1276780 nobody 17784 0.1 S 00:17 /usr/sbin/httpd -k start 2563896 1276780 nobody 17776 0.0 S 00:21 /usr/sbin/httpd -k start 2563967 1276780 nobody 17672 0.1 S 00:17 /usr/sbin/httpd -k start 2563966 1276780 nobody 17660 0.0 S 00:17 /usr/sbin/httpd -k start 2559203 1353308 cpanellogin 17580 0.0 S 07:19 /usr/local/cpanel/base/show_template.stor cpanel_locale docroot /usr/local/cpanel/base server_locale en default_login_theme cpanel 2562290 1276780 nobody 17560 0.0 S 03:03 /usr/sbin/httpd -k start 2563820 1276780 nobody 17416 0.0 S 00:31 /usr/sbin/httpd -k start 2564110 1276780 nobody 17180 0.1 S 00:06 /usr/sbin/httpd -k start 2563961 1276780 nobody 16976 0.0 S 00:18 /usr/sbin/httpd -k start 2563968 1276780 nobody 16976 0.1 S 00:17 /usr/sbin/httpd -k start 2564123 1276780 nobody 16972 0.2 R 00:05 /usr/sbin/httpd -k start 2564271 2564165 root 16912 0.0 D 00:00 /usr/local/cpanel/scripts/restartsrv_pdns --check --notconfigured-ok 2562773 1276780 nobody 16848 0.0 S 02:56 /usr/sbin/httpd -k start 2564124 1276780 nobody 16804 0.0 R 00:05 /usr/sbin/httpd -k start 2564131 1276780 nobody 16788 0.0 S 00:04 /usr/sbin/httpd -k start 2559961 1276780 nobody 16712 0.0 S 06:01 /usr/sbin/httpd -k start 2563955 1276780 nobody 16492 0.0 S 00:19 /usr/sbin/httpd -k start 2564138 1276780 nobody 16328 0.0 S 00:04 /usr/sbin/httpd -k start 2564111 1276780 nobody 16268 0.0 S 00:06 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- 2564271 D - /usr/local/cpanel/scripts/restartsrv_pdns --check --notconfigured-ok --- mariadb processlist (non-sleeping) --- +-----+-------------+-------------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +-----+-------------+-------------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 450 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | | 412 | speedlin_wp | speedlin_wp | Query | 0 | Sending data | SELECT post_id, meta_key, meta_value FROM w50Gr_postmeta WHERE post_id IN (239) ORDER BY meta_id ASC | +-----+-------------+-------------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min candyfabcom/candyfab.com.au-ssl_log 43 candyfabcom/candyfab.com.au 40 lowrange/lowrange.com.au-ssl_log 37 madalice/madalice.com.au-ssl_log 24 evolution/portal.evolutionerp.com.au-ssl_log 18 (total vhosts taking traffic: 5) --- top client IPs across all vhosts (last 3 min) --- 83 4.204.200.143 37 158.23.146.113 18 203.54.180.238 2 5.136.94.22 2 45.169.35.254 2 152.59.147.176 1 47.82.202.191 1 47.82.201.238 1 47.82.201.161 1 43.119.100.169 1 41.214.3.224 1 38.199.7.181 1 2a03:2880:f802:33:: 1 206.0.90.187 1 202.12.123.87 --- top request paths across all vhosts (last 3 min) --- 37 GET /autodiscover/autodiscover.xml 18 GET /heartbeat.php 5 GET / 4 POST / 2 GET /xxxx.php 2 GET /xxw.php 2 GET /xx.php 2 GET /x7.php 2 GET /wsd.php 2 GET /ws37.php 2 GET /ws36.php 2 GET /tx38.php 2 GET /sko.php 2 GET /size.php 2 GET /racs3.php 2 GET /nfile.php 2 GET /moon.php 2 GET /he.php 2 GET /gmo.php 2 GET /geck.php --- busiest 3 vhosts: top paths + last 10 requests --- == candyfabcom/candyfab.com.au-ssl_log == -- top paths -- 1 GET /xxxx.php 1 GET /xxw.php 1 GET /xx.php 1 GET /x7.php 1 GET /wsd.php 1 GET /ws38.php 1 GET /ws37.php 1 GET /ws36.php 1 GET /tx38.php 1 GET /tor.php 1 GET /sko.php 1 GET /size.php -- last 10 requests -- 4.204.200.143 - - [15/Aug/2026:07:26:17 +1000] "GET /moon.php HTTP/1.1" 404 - "-" "-" 4.204.200.143 - - [15/Aug/2026:07:26:17 +1000] "GET /file18.php HTTP/1.1" 404 - "-" "-" 4.204.200.143 - - [15/Aug/2026:07:26:18 +1000] "GET /file21.php HTTP/1.1" 404 - "-" "-" 4.204.200.143 - - [15/Aug/2026:07:26:18 +1000] "GET /xxw.php HTTP/1.1" 404 - "-" "-" 4.204.200.143 - - [15/Aug/2026:07:26:19 +1000] "GET /racs3.php HTTP/1.1" 404 - "-" "-" 4.204.200.143 - - [15/Aug/2026:07:26:19 +1000] "GET /wsd.php HTTP/1.1" 404 - "-" "-" 4.204.200.143 - - [15/Aug/2026:07:26:20 +1000] "GET /333.php HTTP/1.1" 404 - "-" "-" 4.204.200.143 - - [15/Aug/2026:07:26:20 +1000] "GET /12.php HTTP/1.1" 404 - "-" "-" 4.204.200.143 - - [15/Aug/2026:07:26:21 +1000] "GET /moon3.php HTTP/1.1" 404 - "-" "-" 4.204.200.143 - - [15/Aug/2026:07:26:22 +1000] "GET /tor.php HTTP/1.1" 404 - "-" "-" == candyfabcom/candyfab.com.au == -- top paths -- 1 GET /xxxx.php 1 GET /xxw.php 1 GET /xx.php 1 GET /x7.php 1 GET /wsd.php 1 GET /ws37.php 1 GET /ws36.php 1 GET /tx38.php 1 GET /sko.php 1 GET /size.php 1 GET /racs3.php 1 GET /nfile.php -- last 10 requests -- 4.204.200.143 - - [15/Aug/2026:07:26:15 +1000] "GET /class629.php HTTP/1.1" 301 289 "-" "-" 4.204.200.143 - - [15/Aug/2026:07:26:16 +1000] "GET /file9.php HTTP/1.1" 301 286 "-" "-" 4.204.200.143 - - [15/Aug/2026:07:26:17 +1000] "GET /moon.php HTTP/1.1" 301 285 "-" "-" 4.204.200.143 - - [15/Aug/2026:07:26:17 +1000] "GET /file18.php HTTP/1.1" 301 287 "-" "-" 4.204.200.143 - - [15/Aug/2026:07:26:18 +1000] "GET /file21.php HTTP/1.1" 301 287 "-" "-" 4.204.200.143 - - [15/Aug/2026:07:26:18 +1000] "GET /xxw.php HTTP/1.1" 301 284 "-" "-" 4.204.200.143 - - [15/Aug/2026:07:26:19 +1000] "GET /racs3.php HTTP/1.1" 301 286 "-" "-" 4.204.200.143 - - [15/Aug/2026:07:26:19 +1000] "GET /wsd.php HTTP/1.1" 301 284 "-" "-" 4.204.200.143 - - [15/Aug/2026:07:26:20 +1000] "GET /333.php HTTP/1.1" 301 284 "-" "-" 4.204.200.143 - - [15/Aug/2026:07:26:20 +1000] "GET /12.php HTTP/1.1" 301 283 "-" "-" == lowrange/lowrange.com.au-ssl_log == -- top paths -- 37 GET /autodiscover/autodiscover.xml -- last 10 requests -- 158.23.146.113 - - [15/Aug/2026:07:27:58 +1000] "GET /autodiscover/autodiscover.xml HTTP/1.1" 400 52 "-" "-" 158.23.146.113 - - [15/Aug/2026:07:27:59 +1000] "GET /autodiscover/autodiscover.xml HTTP/1.1" 400 52 "-" "-" 158.23.146.113 - - [15/Aug/2026:07:28:00 +1000] "GET /autodiscover/autodiscover.xml HTTP/1.1" 400 52 "-" "-" 158.23.146.113 - - [15/Aug/2026:07:28:01 +1000] "GET /autodiscover/autodiscover.xml HTTP/1.1" 400 52 "-" "-" 158.23.146.113 - - [15/Aug/2026:07:28:02 +1000] "GET /autodiscover/autodiscover.xml HTTP/1.1" 400 52 "-" "-" 158.23.146.113 - - [15/Aug/2026:07:28:03 +1000] "GET /autodiscover/autodiscover.xml HTTP/1.1" 400 52 "-" "-" 158.23.146.113 - - [15/Aug/2026:07:28:03 +1000] "GET /autodiscover/autodiscover.xml HTTP/1.1" 400 52 "-" "-" 158.23.146.113 - - [15/Aug/2026:07:28:04 +1000] "GET /autodiscover/autodiscover.xml HTTP/1.1" 400 52 "-" "-" 158.23.146.113 - - [15/Aug/2026:07:28:05 +1000] "GET /autodiscover/autodiscover.xml HTTP/1.1" 400 52 "-" "-" 158.23.146.113 - - [15/Aug/2026:07:28:06 +1000] "GET /autodiscover/autodiscover.xml HTTP/1.1" 400 52 "-" "-" --- last 30 samples (run-up to this incident) --- 2026-08-15 07:25:58 L1=9.49 run=2 blk=0 avail=9507 (81.1%) swpO=0 conn=12 myRSS=482 php=1 phpRSS=84 ap=31 tcp=18 topuser=alison 2026-08-15 07:25:59 L1=8.81 run=1 blk=0 avail=9640 (82.2%) swpO=0 conn=6 myRSS=482 php=0 phpRSS=0 ap=29 tcp=15 topuser=- 2026-08-15 07:26:08 L1=8.10 run=1 blk=0 avail=9698 (82.7%) swpO=0 conn=1 myRSS=482 php=0 phpRSS=0 ap=20 tcp=15 topuser=- 2026-08-15 07:26:09 L1=7.46 run=1 blk=0 avail=9698 (82.7%) swpO=0 conn=1 myRSS=482 php=0 phpRSS=0 ap=20 tcp=15 topuser=- 2026-08-15 07:26:18 L1=6.94 run=1 blk=0 avail=9689 (82.6%) swpO=0 conn=1 myRSS=482 php=0 phpRSS=0 ap=19 tcp=21 topuser=- 2026-08-15 07:26:19 L1=6.46 run=3 blk=0 avail=9687 (82.6%) swpO=0 conn=1 myRSS=482 php=0 phpRSS=0 ap=19 tcp=19 topuser=- 2026-08-15 07:26:28 L1=5.95 run=2 blk=0 avail=9689 (82.6%) swpO=0 conn=1 myRSS=482 php=0 phpRSS=0 ap=18 tcp=18 topuser=- 2026-08-15 07:26:29 L1=5.47 run=1 blk=0 avail=9686 (82.6%) swpO=0 conn=1 myRSS=482 php=0 phpRSS=0 ap=18 tcp=17 topuser=- 2026-08-15 07:26:38 L1=5.11 run=1 blk=0 avail=9695 (82.7%) swpO=0 conn=1 myRSS=486 php=0 phpRSS=0 ap=17 tcp=14 topuser=- 2026-08-15 07:26:39 L1=4.86 run=1 blk=1 avail=9592 (81.8%) swpO=0 conn=1 myRSS=486 php=1 phpRSS=131 ap=17 tcp=15 topuser=olympic 2026-08-15 07:26:48 L1=4.47 run=2 blk=0 avail=9676 (82.5%) swpO=0 conn=1 myRSS=489 php=0 phpRSS=0 ap=17 tcp=22 topuser=- 2026-08-15 07:26:49 L1=4.11 run=1 blk=0 avail=9675 (82.5%) swpO=0 conn=1 myRSS=489 php=0 phpRSS=0 ap=17 tcp=19 topuser=- 2026-08-15 07:26:58 L1=3.86 run=1 blk=0 avail=9676 (82.5%) swpO=0 conn=1 myRSS=489 php=0 phpRSS=0 ap=17 tcp=17 topuser=- 2026-08-15 07:26:59 L1=3.55 run=2 blk=0 avail=9678 (82.5%) swpO=0 conn=1 myRSS=489 php=0 phpRSS=0 ap=17 tcp=15 topuser=- 2026-08-15 07:27:08 L1=3.35 run=1 blk=0 avail=9645 (82.2%) swpO=0 conn=1 myRSS=505 php=0 phpRSS=0 ap=17 tcp=17 topuser=- 2026-08-15 07:27:10 L1=3.08 run=1 blk=0 avail=9645 (82.2%) swpO=0 conn=1 myRSS=505 php=0 phpRSS=0 ap=17 tcp=13 topuser=- 2026-08-15 07:27:18 L1=2.83 run=1 blk=0 avail=9660 (82.4%) swpO=0 conn=1 myRSS=505 php=0 phpRSS=0 ap=15 tcp=16 topuser=- 2026-08-15 07:27:20 L1=2.61 run=2 blk=0 avail=9659 (82.4%) swpO=0 conn=1 myRSS=505 php=0 phpRSS=0 ap=15 tcp=15 topuser=- 2026-08-15 07:27:28 L1=2.40 run=1 blk=0 avail=9660 (82.4%) swpO=0 conn=1 myRSS=505 php=0 phpRSS=0 ap=15 tcp=14 topuser=- 2026-08-15 07:27:30 L1=2.21 run=1 blk=0 avail=9659 (82.4%) swpO=0 conn=1 myRSS=505 php=0 phpRSS=0 ap=15 tcp=13 topuser=- 2026-08-15 07:27:38 L1=2.03 run=2 blk=0 avail=9659 (82.3%) swpO=0 conn=1 myRSS=505 php=0 phpRSS=0 ap=15 tcp=16 topuser=- 2026-08-15 07:27:40 L1=1.87 run=1 blk=0 avail=9660 (82.4%) swpO=0 conn=1 myRSS=505 php=0 phpRSS=0 ap=15 tcp=19 topuser=- 2026-08-15 07:27:48 L1=1.72 run=1 blk=0 avail=9619 (82.0%) swpO=0 conn=1 myRSS=505 php=0 phpRSS=0 ap=20 tcp=28 topuser=- 2026-08-15 07:27:50 L1=1.58 run=3 blk=0 avail=9611 (81.9%) swpO=0 conn=1 myRSS=505 php=0 phpRSS=0 ap=20 tcp=27 topuser=- 2026-08-15 07:27:58 L1=1.45 run=1 blk=0 avail=9617 (82.0%) swpO=0 conn=1 myRSS=505 php=0 phpRSS=0 ap=21 tcp=27 topuser=- 2026-08-15 07:28:00 L1=1.42 run=1 blk=0 avail=9603 (81.9%) swpO=0 conn=1 myRSS=505 php=0 phpRSS=0 ap=23 tcp=32 topuser=- 2026-08-15 07:28:08 L1=1.46 run=8 blk=0 avail=9106 (77.6%) swpO=0 conn=7 myRSS=506 php=6 phpRSS=603 ap=32 tcp=34 topuser=madalice 2026-08-15 07:28:10 L1=1.83 run=9 blk=0 avail=8457 (72.1%) swpO=0 conn=9 myRSS=506 php=8 phpRSS=1326 ap=32 tcp=36 topuser=madalice 2026-08-15 07:28:18 L1=2.56 run=23 blk=0 avail=7243 (61.8%) swpO=0 conn=20 myRSS=513 php=19 phpRSS=2730 ap=53 tcp=62 topuser=madalice 2026-08-15 07:28:20 L1=4.52 run=22 blk=0 avail=7349 (62.7%) swpO=0 conn=12 myRSS=517 php=13 phpRSS=2257 ap=53 tcp=52 topuser=madalice