INCIDENT 2026-08-15 12:51:16 trigger: php_rss=1795MB ================================================================== load: 1.18 1.05 0.89 20/647 2754215 ncpu:10 mem_avail: 6496MB/11729MB (55.4%) swap_used:1232MB swapout:0/s blocked(D):0 running:15 iowait:0.0% steal:0.0% php: 11 procs / 1795MB heaviest user: madalice (10 procs, 1737MB) apache: 24 procs tcp_estab: 40 --- RSS by user (all processes) --- USER PROCS RSS_MB madalice 10 1960 mysql 1 1601 root 237 737 nobody 23 359 netdata 8 278 evolution 5 76 cpanellogin 1 62 mailnull 4 38 mailman 20 27 dovenull 6 27 wp-toolkit 6 22 zabbix 1 18 lowrange 1 12 dovecot 3 8 nscd 1 7 named 1 7 dbus 1 3 cpanelconnecttrack 1 3 polkitd 1 2 chrony 1 2 --- php workers by user --- USER PROCS RSS_MB madalice 10 1580 evolution 1 79 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5616 MB Active(file): 3750 MB Inactive(file): 1481 MB Dirty: 2 MB Writeback: 0 MB SReclaimable: 338 MB CommitLimit: 9960 MB Committed_AS: 8274 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 2342983 root 11:40:01 236 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2575700 1 mysql 1639604 2.8 Ssl 05:00:37 /usr/sbin/mariadbd 2754169 2753528 madalice 248996 70.3 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2754171 2751952 madalice 234952 104 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1220 1 netdata 217688 2.5 Ssl 47-02:41:19 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 2754174 2751943 madalice 214088 97.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2754172 2753731 madalice 211084 95.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2390233 2382613 root 174940 0.0 S 10:15:39 spamd child 2390234 2382613 root 150192 0.0 S 10:15:39 spamd child 2754180 2754178 madalice 137480 55.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2575382 1 root 109448 0.0 Ss 05:00:40 /usr/lib/systemd/systemd-journald 2754184 2749027 madalice 98728 58.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2754183 2752920 evolution 90756 27.0 R 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 2751924 1353308 cpanellogin 63572 0.3 S 03:22 /usr/local/cpanel/base/show_template.stor server_locale en default_login_theme cpanel cpanel_locale docroot /usr/local/cpanel/base 2754220 2754185 madalice 60864 0.0 R 00:00 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2754221 2754186 madalice 57720 0.0 R 00:00 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2754237 2752779 madalice 46996 0.0 R 00:00 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1353308 1 root 41860 0.0 Ss 24-10:09:49 cpsrvd (SSL) - waiting for connections 1469 1 root 41804 0.1 Ss 47-02:41:18 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 4922 2431 netdata 40688 0.1 Sl 47-02:41:14 /usr/libexec/netdata/plugins.d/go.d.plugin 1 2223 1201 root 40568 0.0 Sl 47-02:41:18 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 2754167 2751238 madalice 28816 71.6 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2382613 1 root 23924 0.0 Ss 10:28:05 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 2753091 2753020 root 23504 0.0 S 01:49 /usr/sbin/exim -q 2746266 1276780 nobody 21156 0.0 S 12:31 /usr/sbin/httpd -k start 2753093 2753091 mailnull 20340 0.0 S 01:49 /usr/sbin/exim -q 2751943 1276780 nobody 20072 0.0 S 03:20 /usr/sbin/httpd -k start 2749027 1276780 nobody 19812 0.0 S 08:29 /usr/sbin/httpd -k start 2752909 1276780 nobody 19352 0.0 S 02:11 /usr/sbin/httpd -k start 2752746 1276780 nobody 18800 0.0 S 02:22 /usr/sbin/httpd -k start 2751238 1276780 nobody 18772 0.0 S 05:07 /usr/sbin/httpd -k start 1204 1 zabbix 18688 0.2 Ssl 47-02:41:19 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 2751952 1276780 nobody 17972 0.0 S 03:19 /usr/sbin/httpd -k start 2752920 1276780 nobody 17844 0.0 S 02:09 /usr/sbin/httpd -k start 2752780 1276780 nobody 17780 0.0 S 02:21 /usr/sbin/httpd -k start 2753528 1276780 nobody 17704 0.0 S 01:07 /usr/sbin/httpd -k start 2751938 1276780 nobody 17608 0.0 S 03:21 /usr/sbin/httpd -k start 2751728 1276780 nobody 17352 0.0 S 03:50 /usr/sbin/httpd -k start 2752779 1276780 nobody 17132 0.0 S 02:21 /usr/sbin/httpd -k start 185104 2431 netdata 17032 2.0 Sl 2-16:17:37 /usr/libexec/netdata/plugins.d/apps.plugin 1 2753822 1276780 nobody 16620 0.0 S 00:37 /usr/sbin/httpd -k start 2753731 1276780 nobody 16520 0.0 S 00:44 /usr/sbin/httpd -k start 2752927 1276780 nobody 16344 0.0 S 02:08 /usr/sbin/httpd -k start 2753740 1276780 nobody 15976 0.0 S 00:43 /usr/sbin/httpd -k start 2754185 1276780 nobody 14872 0.0 S 00:01 /usr/sbin/httpd -k start 2754178 1276780 nobody 14836 0.0 S 00:02 /usr/sbin/httpd -k start 2754186 1276780 nobody 14812 0.0 S 00:01 /usr/sbin/httpd -k start 2753958 1276780 nobody 13684 0.0 S 00:22 /usr/sbin/httpd -k start 1463 1 root 13204 0.0 Ss 47-02:41:18 tailwatchd 2736501 3828812 lowrange 12840 0.0 S 31:00 dovecot/imap 2753020 281734 root 11684 0.0 S 01:54 /usr/sbin/exim -q 2753245 3828812 root 11160 0.0 S 01:29 dovecot/auth -w 2381704 1 root 10320 0.0 Ss 10:29:04 lfd - sleeping 1601939 1471 root 10224 0.0 S 1-05:38:19 cPhulkd - dbprocessor 2753898 1471 root 10064 0.0 S 00:27 cPhulkd - processor - http socket 1059098 3828812 dovenull 8456 0.0 S 1-21:18:24 dovecot/imap-login 2754151 281734 mailnull 8240 0.0 S 00:05 /usr/sbin/exim -ps -bd -q15m -oP /var/spool/exim/exim-daemon.pid 2754118 281734 mailnull 7816 0.0 S 00:08 /usr/sbin/exim -ps -bd -q15m -oP /var/spool/exim/exim-daemon.pid 3651102 1 root 7808 0.0 Ss 7-10:28:32 queueprocd - waiting up to 60s to process a task 1059102 3828812 dovenull 7796 0.0 S 1-21:18:24 dovecot/imap-login 1466 1 root 7588 0.0 Ss 47-02:41:18 dnsadmin - dormant mode --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +-------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +-------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 80575 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +-------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/my.evolutionerp.com.au-ssl_log 111 coscom/coscom.com.au-ssl_log 91 evolution/my.evolutionerp.com.au 83 evolution/wp.evolutionerp.com.au 54 evolution/portal.evolutionerp.com.au-ssl_log 20 evolution/evolutionerp.com.au-ssl_log 15 madalice/madalice.com.au-ssl_log 10 aaa/aaadownunder.com.au-ssl_log 2 (total vhosts taking traffic: 8) --- top client IPs across all vhosts (last 3 min) --- 194 20.7.73.61 91 172.161.0.2 58 20.169.136.165 20 203.54.180.238 4 118.127.40.55 3 54.238.249.23 2 51.89.15.49 2 44.204.223.147 2 185.129.62.63 1 51.68.236.59 1 40.77.179.109 1 192.42.116.93 1 185.220.101.61 1 18.117.16.4 1 157.55.39.58 --- top request paths across all vhosts (last 3 min) --- 20 GET /heartbeat.php 9 GET / 7 GET /wp-login.php 4 GET /store/pink-butterfly-blossom-af1-shoes/ 4 GET /k.php 4 GET /ioxi-o.php 4 GET /403.php 4 GET /0x.php 3 POST /wp-cron.php 3 GET /zxz.php 3 GET /www.php 3 GET /wso.php 3 GET /wp-includes/rest-api/ 3 GET /wp-includes/pomo/ 3 GET /wp-includes/js/tinymce/plugins/compat3x/css/ 3 GET /wp-includes/images/smilies/ 3 GET /wp-includes/images/ 3 GET /wp-includes/ID3/index.php 3 GET /wp-includes/ID3/ 3 GET /wp-includes/html-api/ --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/my.evolutionerp.com.au-ssl_log == -- top paths -- 1 GET /zxz.php 1 GET /xmrlpc.php 1 GET /xmlrpc.php 1 GET /www.php 1 GET /wso.php 1 GET /wp.php 1 GET /wp-mail.php 1 GET /wp-login.php 1 GET /wp-includes/style-engine/index.php 1 GET /wp-includes/style-engine/autoload_classmap.php 1 GET /wp-includes/SimplePie/admin.php 1 GET /wp-includes/rest-api/ -- last 10 requests -- 20.7.73.61 - - [15/Aug/2026:12:49:50 +1000] "GET /file.php HTTP/1.1" 404 - "-" "-" 20.7.73.61 - - [15/Aug/2026:12:49:50 +1000] "GET /epinyins.php HTTP/1.1" 404 - "-" "-" 20.7.73.61 - - [15/Aug/2026:12:49:51 +1000] "GET /wp-admin/css/index.php HTTP/1.1" 404 - "-" "-" 20.7.73.61 - - [15/Aug/2026:12:49:51 +1000] "GET /wp-includes/php-compat/ HTTP/1.1" 404 - "-" "-" 20.7.73.61 - - [15/Aug/2026:12:49:51 +1000] "GET /wp-includes/style-engine/index.php HTTP/1.1" 404 - "-" "-" 20.7.73.61 - - [15/Aug/2026:12:49:52 +1000] "GET /wp-admin/css/colors/coffee/index.php HTTP/1.1" 404 - "-" "-" 20.7.73.61 - - [15/Aug/2026:12:49:52 +1000] "GET /wp.php HTTP/1.1" 404 - "-" "-" 20.7.73.61 - - [15/Aug/2026:12:49:53 +1000] "GET /function/function.php HTTP/1.1" 404 - "-" "-" 20.7.73.61 - - [15/Aug/2026:12:49:54 +1000] "GET /wp-includes/style-engine/autoload_classmap.php HTTP/1.1" 404 - "-" "-" 20.7.73.61 - - [15/Aug/2026:12:49:54 +1000] "GET /wp-includes/SimplePie/admin.php HTTP/1.1" 404 - "-" "-" == coscom/coscom.com.au-ssl_log == -- top paths -- 2 GET /fffm.php 1 GET /Zoo.php 1 GET /zaza.php 1 GET /z60.php 1 GET /xxw.php 1 GET /xwx1.php 1 GET /xrp.php 1 GET /xr.php 1 GET /x.php 1 GET /xml.php 1 GET /wyzer3.php 1 GET /ww1.php -- last 10 requests -- 172.161.0.2 - - [15/Aug/2026:12:51:02 +1000] "GET /plugins.php HTTP/1.1" 401 36 "-" "-" 172.161.0.2 - - [15/Aug/2026:12:51:02 +1000] "GET /modules/mod_simplefileuploadv1.3/elements/i8hqok6nr.php HTTP/1.1" 401 36 "-" "-" 172.161.0.2 - - [15/Aug/2026:12:51:03 +1000] "GET /un.php HTTP/1.1" 401 36 "-" "-" 172.161.0.2 - - [15/Aug/2026:12:51:04 +1000] "GET /oxse.php HTTP/1.1" 401 36 "-" "-" 172.161.0.2 - - [15/Aug/2026:12:51:05 +1000] "GET /coffee.php HTTP/1.1" 401 36 "-" "-" 172.161.0.2 - - [15/Aug/2026:12:51:06 +1000] "GET /bootstrap.php HTTP/1.1" 401 36 "-" "-" 172.161.0.2 - - [15/Aug/2026:12:51:06 +1000] "GET /wp-content/themes/about.php HTTP/1.1" 401 36 "-" "-" 172.161.0.2 - - [15/Aug/2026:12:51:08 +1000] "GET /a3ampzmbipnkpxeqhqpsanCdefault.php HTTP/1.1" 401 36 "-" "-" 172.161.0.2 - - [15/Aug/2026:12:51:08 +1000] "GET /wp-admin/options-privacy.php HTTP/1.1" 401 36 "-" "-" 172.161.0.2 - - [15/Aug/2026:12:51:09 +1000] "GET /login.php HTTP/1.1" 401 36 "-" "-" == evolution/my.evolutionerp.com.au == -- top paths -- 1 GET /zxz.php 1 GET /www.php 1 GET /wso.php 1 GET /wp-login.php 1 GET /wp-includes/rest-api/ 1 GET /wp-includes/pomo/ 1 GET /wp-includes/js/tinymce/plugins/compat3x/css/ 1 GET /wp-includes/js/ 1 GET /wp-includes/images/smilies/ 1 GET /wp-includes/images/ 1 GET /wp-includes/ID3/index.php 1 GET /wp-includes/ID3/ -- last 10 requests -- 20.7.73.61 - - [15/Aug/2026:12:49:32 +1000] "GET /edit.php HTTP/1.1" 301 287 "-" "-" 20.7.73.61 - - [15/Aug/2026:12:49:32 +1000] "GET /wp-includes/rest-api/ HTTP/1.1" 301 300 "-" "-" 20.7.73.61 - - [15/Aug/2026:12:49:33 +1000] "GET /wp-content/themes/twentytwenty/404.php HTTP/1.1" 301 317 "-" "-" 20.7.73.61 - - [15/Aug/2026:12:49:33 +1000] "GET /wp-good.php HTTP/1.1" 301 290 "-" "-" 20.7.73.61 - - [15/Aug/2026:12:49:33 +1000] "GET /wp-admin/js/widgets/ HTTP/1.1" 301 299 "-" "-" 20.7.73.61 - - [15/Aug/2026:12:49:34 +1000] "GET /wp-admin/css/colors/midnight/ HTTP/1.1" 301 308 "-" "-" 20.7.73.61 - - [15/Aug/2026:12:49:34 +1000] "GET /tes.php HTTP/1.1" 301 286 "-" "-" 20.7.73.61 - - [15/Aug/2026:12:49:35 +1000] "GET /files/index.php HTTP/1.1" 301 294 "-" "-" 20.7.73.61 - - [15/Aug/2026:12:49:35 +1000] "GET /wp-content/uploads/index.php HTTP/1.1" 301 307 "-" "-" 20.7.73.61 - - [15/Aug/2026:12:49:36 +1000] "GET /images/images/about.php HTTP/1.1" 301 302 "-" "-" --- last 30 samples (run-up to this incident) --- 2026-08-15 12:48:49 L1=1.17 run=2 blk=0 avail=7953 (67.8%) swpO=0 conn=2 myRSS=1593 php=1 phpRSS=83 ap=20 tcp=19 topuser=evolution 2026-08-15 12:48:55 L1=1.24 run=3 blk=0 avail=7866 (67.1%) swpO=0 conn=2 myRSS=1599 php=2 phpRSS=190 ap=23 tcp=27 topuser=speedlin 2026-08-15 12:48:59 L1=1.30 run=4 blk=0 avail=7950 (67.8%) swpO=0 conn=2 myRSS=1599 php=0 phpRSS=0 ap=26 tcp=26 topuser=- 2026-08-15 12:49:05 L1=1.27 run=1 blk=1 avail=7960 (67.9%) swpO=0 conn=2 myRSS=1599 php=0 phpRSS=0 ap=24 tcp=27 topuser=- 2026-08-15 12:49:09 L1=1.41 run=3 blk=0 avail=7493 (63.9%) swpO=0 conn=2 myRSS=1599 php=3 phpRSS=537 ap=28 tcp=32 topuser=evolution 2026-08-15 12:49:15 L1=1.38 run=1 blk=0 avail=7943 (67.7%) swpO=0 conn=2 myRSS=1599 php=1 phpRSS=17 ap=28 tcp=24 topuser=evolution 2026-08-15 12:49:19 L1=1.43 run=1 blk=0 avail=7944 (67.7%) swpO=0 conn=2 myRSS=1599 php=0 phpRSS=0 ap=28 tcp=25 topuser=- 2026-08-15 12:49:25 L1=1.47 run=1 blk=0 avail=7972 (68.0%) swpO=0 conn=2 myRSS=1599 php=0 phpRSS=0 ap=23 tcp=21 topuser=- 2026-08-15 12:49:29 L1=1.52 run=1 blk=0 avail=7989 (68.1%) swpO=0 conn=1 myRSS=1599 php=0 phpRSS=0 ap=20 tcp=20 topuser=- 2026-08-15 12:49:35 L1=1.72 run=5 blk=0 avail=7708 (65.7%) swpO=0 conn=5 myRSS=1599 php=4 phpRSS=393 ap=20 tcp=25 topuser=evolution 2026-08-15 12:49:39 L1=1.90 run=3 blk=0 avail=7772 (66.3%) swpO=0 conn=1 myRSS=1599 php=2 phpRSS=280 ap=20 tcp=22 topuser=madalice 2026-08-15 12:49:45 L1=1.83 run=4 blk=0 avail=7720 (65.8%) swpO=0 conn=5 myRSS=1599 php=3 phpRSS=357 ap=20 tcp=24 topuser=evolution 2026-08-15 12:49:49 L1=1.92 run=3 blk=0 avail=7784 (66.4%) swpO=0 conn=1 myRSS=1599 php=2 phpRSS=261 ap=20 tcp=22 topuser=evolution 2026-08-15 12:49:55 L1=1.85 run=3 blk=0 avail=7858 (67.0%) swpO=0 conn=5 myRSS=1599 php=2 phpRSS=180 ap=20 tcp=24 topuser=evolution 2026-08-15 12:49:59 L1=1.70 run=2 blk=0 avail=7973 (68.0%) swpO=0 conn=1 myRSS=1599 php=0 phpRSS=0 ap=20 tcp=25 topuser=- 2026-08-15 12:50:05 L1=1.56 run=1 blk=0 avail=7961 (67.9%) swpO=0 conn=5 myRSS=1599 php=1 phpRSS=41 ap=20 tcp=22 topuser=evolution 2026-08-15 12:50:09 L1=1.52 run=1 blk=0 avail=7972 (68.0%) swpO=0 conn=1 myRSS=1599 php=0 phpRSS=0 ap=20 tcp=22 topuser=- 2026-08-15 12:50:15 L1=1.40 run=2 blk=0 avail=7884 (67.2%) swpO=0 conn=5 myRSS=1600 php=2 phpRSS=139 ap=21 tcp=23 topuser=evolution 2026-08-15 12:50:19 L1=1.28 run=1 blk=0 avail=7967 (67.9%) swpO=0 conn=1 myRSS=1600 php=0 phpRSS=0 ap=21 tcp=17 topuser=- 2026-08-15 12:50:25 L1=1.18 run=1 blk=0 avail=7968 (67.9%) swpO=0 conn=5 myRSS=1600 php=1 phpRSS=40 ap=19 tcp=23 topuser=evolution 2026-08-15 12:50:29 L1=1.09 run=2 blk=0 avail=7926 (67.6%) swpO=0 conn=2 myRSS=1600 php=1 phpRSS=88 ap=19 tcp=25 topuser=evolution 2026-08-15 12:50:36 L1=1.32 run=1 blk=0 avail=7936 (67.7%) swpO=0 conn=2 myRSS=1600 php=1 phpRSS=40 ap=23 tcp=24 topuser=evolution 2026-08-15 12:50:39 L1=1.37 run=3 blk=0 avail=7763 (66.2%) swpO=0 conn=2 myRSS=1600 php=2 phpRSS=245 ap=23 tcp=26 topuser=evolution 2026-08-15 12:50:46 L1=1.34 run=3 blk=0 avail=7686 (65.5%) swpO=0 conn=2 myRSS=1600 php=3 phpRSS=356 ap=24 tcp=24 topuser=evolution 2026-08-15 12:50:49 L1=1.32 run=1 blk=0 avail=7944 (67.7%) swpO=0 conn=2 myRSS=1600 php=0 phpRSS=0 ap=24 tcp=25 topuser=- 2026-08-15 12:50:56 L1=1.45 run=4 blk=0 avail=7580 (64.6%) swpO=0 conn=2 myRSS=1600 php=4 phpRSS=459 ap=25 tcp=31 topuser=evolution 2026-08-15 12:50:59 L1=1.41 run=3 blk=0 avail=7855 (67.0%) swpO=0 conn=2 myRSS=1601 php=1 phpRSS=96 ap=25 tcp=21 topuser=evolution 2026-08-15 12:51:06 L1=1.30 run=3 blk=0 avail=7898 (67.3%) swpO=0 conn=2 myRSS=1601 php=1 phpRSS=40 ap=21 tcp=21 topuser=evolution 2026-08-15 12:51:09 L1=1.20 run=2 blk=0 avail=7704 (65.7%) swpO=0 conn=2 myRSS=1601 php=2 phpRSS=306 ap=21 tcp=24 topuser=corpkicks 2026-08-15 12:51:16 L1=1.18 run=15 blk=0 avail=6496 (55.4%) swpO=0 conn=12 myRSS=1601 php=11 phpRSS=1795 ap=24 tcp=40 topuser=madalice