INCIDENT 2026-08-16 22:15:09 trigger: swapout=2366/s ================================================================== load: 1.08 0.75 0.71 4/656 3976819 ncpu:10 mem_avail: 4735MB/11729MB (40.4%) swap_used:1474MB swapout:2366/s blocked(D):1 running:3 iowait:3.6% steal:0.0% php: 2 procs / 273MB heaviest user: corpkicks (1 procs, 204MB) apache: 21 procs tcp_estab: 33 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2320 evolution 8 2021 root 243 1004 nobody 20 305 netdata 8 273 corpkicks 1 207 mailnull 6 121 dovenull 6 27 lowrange 2 24 wp-toolkit 6 22 cpanellogin 1 18 zabbix 1 16 mailman 20 15 aaa 1 13 kurri 1 11 nscd 1 8 named 1 7 dovecot 3 7 polkitd 1 2 dbus 1 2 --- php workers by user --- USER PROCS RSS_MB corpkicks 1 208 evolution 1 68 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 4353 MB Active(file): 2285 MB Inactive(file): 2120 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 473 MB CommitLimit: 9960 MB Committed_AS: 8954 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 3201090 root 21:03:53 8700 /usr/bin/imunify-agent-proxy 3974561 root 02:13 61884 /opt/imunify360/venv/bin/python3 -m imav.run 3976571 root 00:08 2976 /bin/sh -c bash -c "sleep $((RANDOM % 60))" ; /opt/imunify360/venv/share/imunify360/scripts/check-detached.py > /dev/null 2>&1 || : --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2575700 1 mysql 2374572 2.7 Ssl 1-14:24:30 /usr/sbin/mariadbd 3976564 3976563 evolution 1995864 86.0 RNs 00:08 /usr/local/cpanel/3rdparty/bin/analog +CIMAGEDIR /images/ +CDOMAINSFILE /usr/local/cpanel/3rdparty/share/analog/usdom.tab +CCHARTDIR ./ 1220 1 netdata 223252 2.5 Ssl 48-12:05:12 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 3976750 3974223 corpkicks 216272 57.5 R 00:02 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 3255082 3247260 root 173020 0.0 S 19:39:19 spamd child 3767579 3247260 root 167076 0.0 S 05:42:31 spamd child 3247260 1 root 139684 0.0 Ss 19:51:49 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 2575382 1 root 109316 0.0 Ss 1-14:24:33 /usr/lib/systemd/systemd-journald 3976603 3976570 evolution 70428 2.8 Ss 00:08 /opt/cpanel/ea-php74/root/usr/bin/php-cgi /home/evolution/my.evolutionerp.com.au/cron/xero2.php 3974561 1 root 61884 1.3 Ssl 02:13 /opt/imunify360/venv/bin/python3 -m imav.run 2223 1201 root 43288 0.0 Sl 48-12:05:11 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1469 1 root 42176 0.1 Ss 48-12:05:11 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 1353308 1 root 41772 0.0 Ss 25-19:33:42 cpsrvd (SSL) - waiting for connections 3976766 1469 root 39376 1.0 S 00:01 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 3976850 1469 root 39372 0.0 S 00:00 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 4922 2431 netdata 33728 0.1 Sl 48-12:05:07 /usr/libexec/netdata/plugins.d/go.d.plugin 1 3246151 1 root 27256 0.0 Ss 19:52:46 lfd - sleeping 3974305 3651816 root 26052 0.6 SN 02:14 cpanellogd - waiting for child to process logs for evolution 3976448 3974305 evolution 24696 0.3 SN 00:13 cpanellogd - http logs for evolution 281734 1 mailnull 23076 0.0 Ss 7-19:53:00 /usr/sbin/exim -ps -bd -q15m -oP /var/spool/exim/exim-daemon.pid 3976212 281734 mailnull 23012 0.0 S 00:27 /usr/sbin/exim -ps -bd -q15m -oP /var/spool/exim/exim-daemon.pid 3975924 281734 mailnull 20512 0.0 S 00:41 /usr/sbin/exim -ps -bd -q15m -oP /var/spool/exim/exim-daemon.pid 3976022 281734 mailnull 20456 0.0 S 00:34 /usr/sbin/exim -ps -bd -q15m -oP /var/spool/exim/exim-daemon.pid 3974214 1276780 nobody 19672 0.0 S 02:18 /usr/sbin/httpd -k start 3973663 1276780 nobody 19452 0.0 S 03:12 /usr/sbin/httpd -k start 3972837 1276780 nobody 19448 0.0 S 05:00 /usr/sbin/httpd -k start 3973599 1276780 nobody 19416 0.0 S 03:23 /usr/sbin/httpd -k start 3972981 1276780 nobody 19156 0.0 S 04:33 /usr/sbin/httpd -k start 3970681 1353308 cpanellogin 19052 0.0 S 09:35 /usr/local/cpanel/base/show_template.stor default_login_theme cpanel server_locale en docroot /usr/local/cpanel/base cpanel_locale 3976735 281734 mailnull 18744 0.0 S 00:04 /usr/sbin/exim -ps -bd -q15m -oP /var/spool/exim/exim-daemon.pid 3972388 1276780 nobody 18712 0.0 S 05:44 /usr/sbin/httpd -k start 3976653 281734 mailnull 18640 0.0 S 00:07 /usr/sbin/exim -ps -bd -q15m -oP /var/spool/exim/exim-daemon.pid 3972983 1276780 nobody 18580 0.0 S 04:33 /usr/sbin/httpd -k start 3974223 1276780 nobody 18184 0.1 S 02:17 /usr/sbin/httpd -k start 3972965 1276780 nobody 17356 0.0 S 04:35 /usr/sbin/httpd -k start 1204 1 zabbix 17072 0.2 Ssl 48-12:05:12 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 3974224 1276780 nobody 16852 0.0 S 02:17 /usr/sbin/httpd -k start 3975588 1276780 nobody 16852 0.0 S 00:59 /usr/sbin/httpd -k start 3975731 1276780 nobody 16500 0.0 S 00:50 /usr/sbin/httpd -k start 3488735 1471 root 16452 0.0 S 13:27:42 cPhulkd - dbprocessor 3975452 1276780 nobody 16076 0.0 S 01:10 /usr/sbin/httpd -k start 3975729 1276780 nobody 16036 0.0 S 00:50 /usr/sbin/httpd -k start 1471 1 root 15792 0.0 Ss 48-12:05:11 cPhulkd - processor 185104 2431 netdata 15768 2.0 Sl 4-01:41:30 /usr/libexec/netdata/plugins.d/apps.plugin 1 3975713 1276780 nobody 15244 0.2 S 00:51 /usr/sbin/httpd -k start 3975520 1276780 nobody 15168 0.0 S 01:03 /usr/sbin/httpd -k start 1463 1 root 14852 0.0 Ss 48-12:05:11 tailwatchd 3976447 1471 root 13900 0.0 S 00:13 cPhulkd - processor - http socket 3959600 3828812 aaa 13764 0.0 S 27:49 dovecot/imap 3975518 1276780 nobody 13588 0.0 S 01:04 /usr/sbin/httpd -k start 3975589 1276780 nobody 13588 0.0 S 00:59 /usr/sbin/httpd -k start 3966444 3828812 lowrange 12472 0.0 S 16:29 dovecot/imap 3971676 3828812 lowrange 12288 0.0 S 07:24 dovecot/imap 3816866 3828812 kurri 11728 0.0 S 04:24:08 dovecot/imap 3975723 3828812 root 11000 0.0 S 00:50 dovecot/auth -w 3651378 1 nscd 8732 0.0 Ssl 8-19:52:14 /usr/sbin/nscd 3201090 1 root 8700 0.0 Ssl 21:03:53 /usr/bin/imunify-agent-proxy 1059098 3828812 dovenull 8568 0.0 S 3-06:42:17 dovecot/imap-login 1059102 3828812 dovenull 8088 0.0 S 3-06:42:17 dovecot/imap-login 2536732 1 named 7524 0.0 Ssl 44-19:52:59 /usr/sbin/pdns_server --socket-dir=/run/pdns --guardian=no --daemon=no --disable-syslog --log-timestamp=no --write-pid=no --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +--------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +--------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 404803 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +--------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min alison/alisonarts.com.au-ssl_log 255 whiz/whizengineering.com.au 44 tubesupplies/tubesupplies.com.au-ssl_log 30 evolution/portal.evolutionerp.com.au-ssl_log 23 (total vhosts taking traffic: 4) --- top client IPs across all vhosts (last 3 min) --- 129 40.74.65.169 118 158.23.18.197 44 20.196.200.88 30 20.163.43.14 23 203.54.180.238 3 217.113.194.167 2 217.113.194.235 1 217.113.194.170 1 217.113.194.168 1 1.12.70.96 --- top request paths across all vhosts (last 3 min) --- 23 GET /heartbeat.php 4 GET /admin.php 3 GET /wp-content/uploads/ 3 GET /wp-content/plugins/hellopress/wp_filemanager.php 3 GET /this_is_a_new_hello_world.php 3 GET /edit.php 2 GET /xxx.php 2 GET /wp-includes/Text/ 2 GET /wp-includes/block-bindings/ 2 GET /wp-good.php 2 GET /wp-content/themes/index.php 2 GET /wp-content/admin.php 2 GET /wp-blog.php 2 GET /wp-admin/css/colors/sunrise/ 2 GET /wp-admin/css/colors/modern/ 2 GET /sf.php 2 GET /puc.php 2 GET /ops.php 2 GET /ms-edit.php 2 GET /media.php --- busiest 3 vhosts: top paths + last 10 requests --- == alison/alisonarts.com.au-ssl_log == -- top paths -- 3 GET /admin.php 2 GET /xxx.php 2 GET /wp-content/plugins/hellopress/wp_filemanager.php 2 GET /wp-content/admin.php 2 GET /this_is_a_new_hello_world.php 2 GET /gec.php 2 GET /file59.php 2 GET /file52.php 2 GET /edit.php 2 GET /222.php 2 GET /155.php 1 GET /zz.php -- last 10 requests -- 40.74.65.169 - - [16/Aug/2026:22:15:07 +1000] "GET /insc.php HTTP/1.1" 404 5749 "-" "-" 158.23.18.197 - - [16/Aug/2026:22:15:07 +1000] "GET /maxro.php HTTP/1.1" 401 36 "-" "-" 40.74.65.169 - - [16/Aug/2026:22:15:07 +1000] "GET /file.php HTTP/1.1" 404 5749 "-" "-" 158.23.18.197 - - [16/Aug/2026:22:15:08 +1000] "GET /wdf.php HTTP/1.1" 401 36 "-" "-" 40.74.65.169 - - [16/Aug/2026:22:15:08 +1000] "GET /dex.php HTTP/1.1" 404 5749 "-" "-" 158.23.18.197 - - [16/Aug/2026:22:15:08 +1000] "GET /ff1.php HTTP/1.1" 401 36 "-" "-" 40.74.65.169 - - [16/Aug/2026:22:15:08 +1000] "GET /key.php HTTP/1.1" 404 5749 "-" "-" 158.23.18.197 - - [16/Aug/2026:22:15:08 +1000] "GET /guk.php HTTP/1.1" 401 36 "-" "-" 40.74.65.169 - - [16/Aug/2026:22:15:08 +1000] "GET /yyy.php HTTP/1.1" 404 5749 "-" "-" 40.74.65.169 - - [16/Aug/2026:22:15:09 +1000] "GET /thoms.php HTTP/1.1" 404 5749 "-" "-" == whiz/whizengineering.com.au == -- top paths -- 1 GET /xx.php 1 GET /wp-includes/Text/ 1 GET //wp-includes/l10n/ 1 GET //wp-includes/js/jquery/ 1 GET //wp-includes/css/dist/ 1 GET //wp-includes/assets/ 1 GET /wp-content/uploads/ 1 GET /wp-content/themes/index.php 1 GET /wp-content/plugins/hellopress/wp_filemanager.php 1 GET //wp-content/admin.php 1 GET /wp-blog.php 1 GET /wp-admin/css/colors/sunrise/ -- last 10 requests -- 20.196.200.88 - - [16/Aug/2026:22:14:35 +1000] "GET /adminner.php HTTP/1.1" 404 - "-" "-" 20.196.200.88 - - [16/Aug/2026:22:14:35 +1000] "GET //cgi-bin/index.php HTTP/1.1" 404 - "-" "-" 20.196.200.88 - - [16/Aug/2026:22:14:35 +1000] "GET //wp-includes/css/dist/ HTTP/1.1" 404 - "-" "-" 20.196.200.88 - - [16/Aug/2026:22:14:35 +1000] "GET //abcd.php HTTP/1.1" 404 - "-" "-" 20.196.200.88 - - [16/Aug/2026:22:14:36 +1000] "GET /wp-content/themes/index.php HTTP/1.1" 404 - "-" "-" 20.196.200.88 - - [16/Aug/2026:22:14:36 +1000] "GET /wp-includes/Text/ HTTP/1.1" 404 - "-" "-" 20.196.200.88 - - [16/Aug/2026:22:14:36 +1000] "GET /wp-blog.php HTTP/1.1" 404 - "-" "-" 20.196.200.88 - - [16/Aug/2026:22:14:36 +1000] "GET /chosen.php? HTTP/1.1" 404 - "-" "-" 20.196.200.88 - - [16/Aug/2026:22:14:36 +1000] "GET /about.php? HTTP/1.1" 404 - "-" "-" 20.196.200.88 - - [16/Aug/2026:22:14:37 +1000] "GET /inputs.php? HTTP/1.1" 404 - "-" "-" == tubesupplies/tubesupplies.com.au-ssl_log == -- top paths -- 1 GET /xmlrpc.php 1 GET /wp-login.php 1 GET /wp-includes/rest-api/ 1 GET /wp-includes/js/crop/ 1 GET /wp-includes/images/smilies/about.php 1 GET /wp-includes/images/smilies/ 1 GET /wp-includes/ID3/ 1 GET /wp-includes/block-bindings/ 1 GET /wp-good.php 1 GET /wp-content/uploads/ 1 GET /wp-content/themes/twentytwenty/404.php 1 GET /wp-content/themes/ -- last 10 requests -- 20.163.43.14 - - [16/Aug/2026:22:13:06 +1000] "GET /rip.php HTTP/1.1" 401 36 "-" "-" 20.163.43.14 - - [16/Aug/2026:22:13:07 +1000] "GET /wp-content/uploads/ HTTP/1.1" 401 36 "-" "-" 20.163.43.14 - - [16/Aug/2026:22:13:07 +1000] "GET /xmlrpc.php HTTP/1.1" 401 36 "-" "-" 20.163.43.14 - - [16/Aug/2026:22:13:07 +1000] "GET /moon.php HTTP/1.1" 401 36 "-" "-" 20.163.43.14 - - [16/Aug/2026:22:13:08 +1000] "GET /cache.php HTTP/1.1" 401 36 "-" "-" 20.163.43.14 - - [16/Aug/2026:22:13:08 +1000] "GET /wp-includes/block-bindings/ HTTP/1.1" 401 36 "-" "-" 20.163.43.14 - - [16/Aug/2026:22:13:08 +1000] "GET /vendor/ HTTP/1.1" 401 36 "-" "-" 20.163.43.14 - - [16/Aug/2026:22:13:09 +1000] "GET /wp-content/themes/ HTTP/1.1" 401 36 "-" "-" 20.163.43.14 - - [16/Aug/2026:22:13:09 +1000] "GET /wp-includes/images/smilies/about.php HTTP/1.1" 401 36 "-" "-" 20.163.43.14 - - [16/Aug/2026:22:13:09 +1000] "GET /wp-includes/js/crop/ HTTP/1.1" 401 36 "-" "-" --- last 30 samples (run-up to this incident) --- 2026-08-16 22:12:48 L1=0.52 run=2 blk=0 avail=6837 (58.3%) swpO=0 conn=2 myRSS=2379 php=0 phpRSS=0 ap=15 tcp=23 topuser=- 2026-08-16 22:12:48 L1=0.52 run=3 blk=0 avail=6836 (58.3%) swpO=0 conn=2 myRSS=2379 php=0 phpRSS=0 ap=15 tcp=23 topuser=- 2026-08-16 22:12:58 L1=0.59 run=5 blk=0 avail=6588 (56.2%) swpO=0 conn=2 myRSS=2379 php=0 phpRSS=0 ap=17 tcp=23 topuser=- 2026-08-16 22:12:58 L1=0.59 run=5 blk=0 avail=6588 (56.2%) swpO=0 conn=2 myRSS=2379 php=0 phpRSS=0 ap=17 tcp=21 topuser=- 2026-08-16 22:13:08 L1=0.65 run=5 blk=0 avail=6513 (55.5%) swpO=0 conn=3 myRSS=2379 php=2 phpRSS=191 ap=17 tcp=22 topuser=corpkicks 2026-08-16 22:13:08 L1=0.65 run=6 blk=0 avail=6515 (55.5%) swpO=0 conn=3 myRSS=2379 php=2 phpRSS=189 ap=17 tcp=22 topuser=corpkicks 2026-08-16 22:13:18 L1=0.78 run=3 blk=0 avail=6474 (55.2%) swpO=0 conn=3 myRSS=2379 php=0 phpRSS=0 ap=17 tcp=21 topuser=- 2026-08-16 22:13:18 L1=0.78 run=3 blk=0 avail=6474 (55.2%) swpO=0 conn=3 myRSS=2379 php=0 phpRSS=0 ap=17 tcp=21 topuser=- 2026-08-16 22:13:28 L1=0.88 run=2 blk=0 avail=5722 (48.8%) swpO=97 conn=3 myRSS=2379 php=4 phpRSS=385 ap=17 tcp=29 topuser=evolution 2026-08-16 22:13:28 L1=0.88 run=5 blk=0 avail=5717 (48.7%) swpO=131 conn=3 myRSS=2378 php=4 phpRSS=385 ap=17 tcp=29 topuser=evolution 2026-08-16 22:13:38 L1=0.82 run=1 blk=0 avail=6771 (57.7%) swpO=96 conn=3 myRSS=2377 php=0 phpRSS=0 ap=15 tcp=18 topuser=- 2026-08-16 22:13:38 L1=0.82 run=3 blk=0 avail=6770 (57.7%) swpO=62 conn=3 myRSS=2377 php=0 phpRSS=0 ap=15 tcp=17 topuser=- 2026-08-16 22:13:48 L1=0.77 run=1 blk=1 avail=6772 (57.7%) swpO=0 conn=3 myRSS=2377 php=0 phpRSS=0 ap=15 tcp=21 topuser=- 2026-08-16 22:13:48 L1=0.77 run=4 blk=1 avail=6770 (57.7%) swpO=0 conn=3 myRSS=2377 php=0 phpRSS=0 ap=15 tcp=21 topuser=- 2026-08-16 22:13:58 L1=0.73 run=2 blk=0 avail=6771 (57.7%) swpO=0 conn=3 myRSS=2377 php=0 phpRSS=0 ap=15 tcp=23 topuser=- 2026-08-16 22:13:58 L1=0.73 run=3 blk=0 avail=6775 (57.8%) swpO=0 conn=3 myRSS=2377 php=0 phpRSS=0 ap=15 tcp=23 topuser=- 2026-08-16 22:14:08 L1=0.70 run=4 blk=1 avail=6707 (57.2%) swpO=0 conn=2 myRSS=2377 php=1 phpRSS=73 ap=20 tcp=26 topuser=alison 2026-08-16 22:14:08 L1=0.70 run=4 blk=0 avail=6705 (57.2%) swpO=0 conn=2 myRSS=2377 php=1 phpRSS=75 ap=20 tcp=26 topuser=alison 2026-08-16 22:14:18 L1=0.74 run=1 blk=0 avail=6723 (57.3%) swpO=0 conn=2 myRSS=2377 php=0 phpRSS=0 ap=23 tcp=30 topuser=- 2026-08-16 22:14:18 L1=0.74 run=3 blk=0 avail=6722 (57.3%) swpO=0 conn=2 myRSS=2377 php=0 phpRSS=0 ap=23 tcp=30 topuser=- 2026-08-16 22:14:28 L1=0.62 run=2 blk=0 avail=6700 (57.1%) swpO=0 conn=2 myRSS=2377 php=0 phpRSS=0 ap=26 tcp=31 topuser=- 2026-08-16 22:14:29 L1=0.62 run=6 blk=0 avail=6689 (57.0%) swpO=0 conn=2 myRSS=2377 php=0 phpRSS=0 ap=25 tcp=31 topuser=- 2026-08-16 22:14:39 L1=0.61 run=1 blk=0 avail=6706 (57.2%) swpO=0 conn=2 myRSS=2377 php=0 phpRSS=0 ap=24 tcp=29 topuser=- 2026-08-16 22:14:39 L1=0.61 run=2 blk=0 avail=6705 (57.2%) swpO=0 conn=2 myRSS=2377 php=0 phpRSS=0 ap=24 tcp=29 topuser=- 2026-08-16 22:14:49 L1=0.60 run=1 blk=0 avail=6706 (57.2%) swpO=0 conn=2 myRSS=2377 php=0 phpRSS=0 ap=24 tcp=29 topuser=- 2026-08-16 22:14:49 L1=0.60 run=4 blk=0 avail=6705 (57.2%) swpO=0 conn=2 myRSS=2377 php=0 phpRSS=0 ap=24 tcp=29 topuser=- 2026-08-16 22:14:59 L1=0.66 run=2 blk=0 avail=6493 (55.4%) swpO=0 conn=2 myRSS=2377 php=0 phpRSS=0 ap=22 tcp=30 topuser=- 2026-08-16 22:14:59 L1=0.66 run=3 blk=0 avail=6487 (55.3%) swpO=0 conn=2 myRSS=2377 php=0 phpRSS=0 ap=22 tcp=30 topuser=- 2026-08-16 22:15:09 L1=1.08 run=3 blk=1 avail=4735 (40.4%) swpO=2366 conn=3 myRSS=2320 php=2 phpRSS=273 ap=21 tcp=33 topuser=corpkicks 2026-08-16 22:15:09 L1=1.08 run=8 blk=0 avail=4720 (40.2%) swpO=2392 conn=3 myRSS=2320 php=2 phpRSS=275 ap=21 tcp=33 topuser=corpkicks