INCIDENT 2026-08-17 19:30:30 trigger: php_rss=1514MB ================================================================== load: 2.74 1.12 0.80 13/669 743783 ncpu:10 mem_avail: 5701MB/11729MB (48.6%) swap_used:2088MB swapout:763/s blocked(D):0 running:14 iowait:0.2% steal:0.0% php: 12 procs / 1514MB heaviest user: madalice (10 procs, 1333MB) apache: 41 procs tcp_estab: 30 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2401 madalice 9 1253 root 237 975 nobody 40 622 netdata 8 254 alison 1 151 evolution 5 43 mailnull 3 27 dovenull 6 27 cpanellogin 1 19 wp-toolkit 6 18 mailman 20 14 zabbix 1 13 vinesit 1 12 infinium 1 12 lowrange 1 11 corpkicks 1 11 kurri 1 10 dovecot 3 8 nscd 1 7 --- php workers by user --- USER PROCS RSS_MB madalice 9 1262 alison 1 151 evolution 1 39 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5549 MB Active(file): 4172 MB Inactive(file): 822 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 433 MB CommitLimit: 9960 MB Committed_AS: 8900 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 741974 root 03:24 60776 /opt/imunify360/venv/bin/python3 -m imav.run 4090795 root 18:19:14 3052 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2575700 1 mysql 2459524 7.4 Ssl 2-11:39:53 /usr/sbin/mariadbd 502627 4140634 root 218128 0.1 S 05:36:41 spamd child 1220 1 netdata 203916 2.5 Ssl 49-09:20:35 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 743717 742671 madalice 197276 64.3 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2575382 1 root 170432 0.0 Ss 2-11:39:56 /usr/lib/systemd/systemd-journald 743728 743612 madalice 158276 63.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 743727 743611 madalice 153760 63.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 743729 743613 madalice 150508 61.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 4146604 4140634 root 139300 0.0 S 16:57:24 spamd child 4140634 1 root 136360 0.0 Ss 17:07:45 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 743726 743610 madalice 134048 54.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 743730 741889 madalice 120324 48.5 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 743732 743615 madalice 98968 65.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 743733 743616 madalice 95996 63.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 741974 1 root 60776 0.7 Ssl 03:25 /opt/imunify360/venv/bin/python3 -m imav.run 2223 1201 root 43648 0.0 Sl 49-09:20:34 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1353308 1 root 41512 0.0 Ss 26-16:49:05 cpsrvd (SSL) - waiting for connections 743731 743617 evolution 40868 3.0 S 00:01 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 4922 2431 netdata 33952 0.1 Sl 49-09:20:30 /usr/libexec/netdata/plugins.d/go.d.plugin 1 1469 1 root 30472 0.1 Ss 49-09:20:34 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 743718 741884 madalice 28900 83.0 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 4139988 1 root 26696 0.0 Ss 17:08:18 lfd - sleeping 743723 742672 alison 24000 44.3 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 735521 1276780 nobody 23388 0.0 S 16:14 /usr/sbin/httpd -k start 742355 1276780 nobody 19964 0.0 S 02:41 /usr/sbin/httpd -k start 741884 1276780 nobody 19796 0.0 S 03:35 /usr/sbin/httpd -k start 738936 1353308 cpanellogin 19676 0.0 S 10:00 /usr/local/cpanel/base/show_template.stor cpanel_locale docroot /usr/local/cpanel/base server_locale en default_login_theme cpanel 739478 1276780 nobody 19648 0.0 S 08:55 /usr/sbin/httpd -k start 741889 1276780 nobody 19452 0.0 S 03:34 /usr/sbin/httpd -k start 742671 1276780 nobody 19332 0.0 S 01:53 /usr/sbin/httpd -k start 742662 1276780 nobody 19036 0.0 S 01:54 /usr/sbin/httpd -k start 742659 1276780 nobody 19008 0.1 S 01:55 /usr/sbin/httpd -k start 743624 1276780 nobody 18248 0.3 S 00:12 /usr/sbin/httpd -k start 743625 1276780 nobody 18144 0.3 S 00:12 /usr/sbin/httpd -k start 743611 1276780 nobody 18036 0.0 S 00:12 /usr/sbin/httpd -k start 742672 1276780 nobody 17976 0.1 S 01:53 /usr/sbin/httpd -k start 743612 1276780 nobody 17800 0.0 S 00:12 /usr/sbin/httpd -k start 743145 1276780 nobody 17468 0.0 S 01:00 /usr/sbin/httpd -k start 743607 1276780 nobody 17352 0.1 S 00:13 /usr/sbin/httpd -k start 743593 1276780 nobody 17320 0.1 S 00:15 /usr/sbin/httpd -k start 743590 1276780 nobody 17272 0.1 S 00:16 /usr/sbin/httpd -k start 743595 1276780 nobody 17224 0.1 S 00:14 /usr/sbin/httpd -k start 743606 1276780 nobody 17216 0.2 S 00:13 /usr/sbin/httpd -k start 742682 1276780 nobody 17184 0.0 S 01:52 /usr/sbin/httpd -k start 743604 1276780 nobody 17136 0.2 S 00:13 /usr/sbin/httpd -k start 743689 1276780 nobody 17068 0.1 S 00:08 /usr/sbin/httpd -k start 743592 1276780 nobody 17044 0.1 S 00:15 /usr/sbin/httpd -k start 743601 1276780 nobody 17004 0.1 S 00:13 /usr/sbin/httpd -k start 743603 1276780 nobody 16340 0.0 S 00:13 /usr/sbin/httpd -k start 743614 1276780 nobody 15592 0.0 S 00:12 /usr/sbin/httpd -k start 185104 2431 netdata 15512 2.0 Sl 4-22:56:53 /usr/libexec/netdata/plugins.d/apps.plugin 1 743610 1276780 nobody 15448 0.0 S 00:12 /usr/sbin/httpd -k start 743594 1276780 nobody 15424 0.1 S 00:14 /usr/sbin/httpd -k start 743617 1276780 nobody 15312 0.0 S 00:12 /usr/sbin/httpd -k start 38372 1471 root 15224 0.0 S 14:41:09 cPhulkd - dbprocessor 743615 1276780 nobody 14804 0.0 S 00:12 /usr/sbin/httpd -k start 743616 1276780 nobody 14800 0.0 S 00:12 /usr/sbin/httpd -k start 743613 1276780 nobody 14796 0.0 S 00:12 /usr/sbin/httpd -k start 743620 1276780 nobody 14796 0.0 S 00:12 /usr/sbin/httpd -k start 743621 1276780 nobody 14780 0.0 S 00:12 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 4912030 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min kurri/kurrimotorinn.com.au 91 madalice/madalice.com.au-ssl_log 49 evolution/wp.evolutionerp.com.au 33 alison/alisonarts.com.au-ssl_log 29 evolution/portal.evolutionerp.com.au-ssl_log 21 cosgrovecreative/cosgrovecreative.com.au-ssl_log 18 (total vhosts taking traffic: 6) --- top client IPs across all vhosts (last 3 min) --- 91 135.225.75.187 33 85.204.70.92 27 185.177.72.54 22 20.51.153.15 21 203.54.180.238 18 85.204.70.104 5 2a09:bac0:1000:c48::2db:14 5 2a09:bac0:1000:c48::1c:346 4 2a09:bac0:1000:c48::21f:73 3 143.95.144.95 2 148.251.41.182 2 114.119.159.70 2 114.119.137.101 1 37.59.204.153 1 172.161.79.158 --- top request paths across all vhosts (last 3 min) --- 21 GET /heartbeat.php 14 HEAD / 6 GET / 2 GET /wp-login.php 2 GET /wp-content/plugins/hellopress/wp_filemanager.php 2 GET /wp-admin/ 2 GET /this_is_a_new_hello_world.php 2 GET /store/hand-painted-nike-af1-justin/ 2 GET /store/hand-painted-nike-af1-everton/ 1 POST / 1 GET /zxin.php 1 GET /zwq13.php 1 GET /z.php 1 GET /zkotynva.php 1 GET /zip.php 1 GET /ze.php 1 GET /xxx.php 1 GET /xqq.php 1 GET /xmlrpc.php 1 GET //xmlrpc.php --- busiest 3 vhosts: top paths + last 10 requests --- == kurri/kurrimotorinn.com.au == -- top paths -- 1 GET /zxin.php 1 GET /zwq13.php 1 GET /z.php 1 GET /ze.php 1 GET /xxx.php 1 GET /xqq.php 1 GET /X57.php 1 GET /ws62.php 1 GET /ws61.php 1 GET /ws60.php 1 GET /ws59.php 1 GET /wpver.php -- last 10 requests -- 135.225.75.187 - - [17/Aug/2026:19:30:17 +1000] "GET /166.php HTTP/1.1" 404 - "-" "-" 135.225.75.187 - - [17/Aug/2026:19:30:18 +1000] "GET /snq.php HTTP/1.1" 404 - "-" "-" 135.225.75.187 - - [17/Aug/2026:19:30:18 +1000] "GET /wp-access.php HTTP/1.1" 404 - "-" "-" 135.225.75.187 - - [17/Aug/2026:19:30:18 +1000] "GET /nw.php HTTP/1.1" 404 - "-" "-" 135.225.75.187 - - [17/Aug/2026:19:30:19 +1000] "GET /ws62.php HTTP/1.1" 404 - "-" "-" 135.225.75.187 - - [17/Aug/2026:19:30:19 +1000] "GET /public/vx.php HTTP/1.1" 404 - "-" "-" 135.225.75.187 - - [17/Aug/2026:19:30:19 +1000] "GET /loxi-o.php HTTP/1.1" 404 - "-" "-" 135.225.75.187 - - [17/Aug/2026:19:30:20 +1000] "GET /sdsa.php HTTP/1.1" 404 - "-" "-" 135.225.75.187 - - [17/Aug/2026:19:30:20 +1000] "GET /wp-freya.php HTTP/1.1" 404 - "-" "-" 135.225.75.187 - - [17/Aug/2026:19:30:20 +1000] "GET /fleen.php HTTP/1.1" 404 - "-" "-" == madalice/madalice.com.au-ssl_log == -- top paths -- 14 HEAD / 4 GET / 2 GET /store/hand-painted-nike-af1-justin/ 2 GET /store/hand-painted-nike-af1-everton/ 1 POST / 1 GET /wp-json/gravitysmtp/v1/tests/mock-data 1 GET /store/design-your-own-wedding-shoes/ 1 GET /store/design-your-own-sports-team-sneakers/ 1 GET /store/design-your-own-sneakers/ 1 GET /store/design-your-own-sliders/ 1 GET /store/design-your-own-pet-themed-sneakers/ 1 GET /store/design-your-own-kids-shoes/ -- last 10 requests -- 185.177.72.54 - - [17/Aug/2026:19:30:25 +1000] "GET /custom-wedding-sneakers-australia/ HTTP/1.1" 200 37364 "-" "curl/8.7.1" 185.177.72.54 - - [17/Aug/2026:19:30:26 +1000] "GET /store/design-your-own-sneakers/ HTTP/1.1" 200 49139 "-" "curl/8.7.1" 185.177.72.54 - - [17/Aug/2026:19:30:26 +1000] "GET /store/custom-shoes/ HTTP/1.1" 200 55250 "-" "curl/8.7.1" 185.177.72.54 - - [17/Aug/2026:19:30:27 +1000] "GET /store/design-your-own-kids-shoes/ HTTP/1.1" 200 52343 "-" "curl/8.7.1" 185.177.72.54 - - [17/Aug/2026:19:30:27 +1000] "GET /store/design-your-own-wedding-shoes/ HTTP/1.1" 200 49575 "-" "curl/8.7.1" 185.177.72.54 - - [17/Aug/2026:19:30:27 +1000] "GET /store/design-your-own-sports-team-sneakers/ HTTP/1.1" 200 48613 "-" "curl/8.7.1" 185.177.72.54 - - [17/Aug/2026:19:30:27 +1000] "GET /store/design-your-own-pet-themed-sneakers/ HTTP/1.1" 200 47791 "-" "curl/8.7.1" 185.177.72.54 - - [17/Aug/2026:19:30:28 +1000] "GET /store/design-your-own-sliders/ HTTP/1.1" 200 48480 "-" "curl/8.7.1" 185.177.72.54 - - [17/Aug/2026:19:30:28 +1000] "GET /store/create-your-own-nike-af1-colourway/ HTTP/1.1" 200 47402 "-" "curl/8.7.1" 185.177.72.54 - - [17/Aug/2026:19:30:29 +1000] "GET /product-category/socks/ HTTP/1.1" 200 31469 "-" "curl/8.7.1" == evolution/wp.evolutionerp.com.au == -- top paths -- 1 GET /wp-includes/style-engine//wp-includes/ 1 GET /wp-includes/style-engine.php 1 GET /wp-includes/style-engine/class-wp-style-engine-css-rule.php 1 GET /wp-includes/style-engine/class-wp-style-engine-css-declarations.php 1 GET /wp-includes/style-engine/ 1 GET /wp-includes/speculative-loading.php 1 GET /wp-includes/sodium_compat//wp-includes/ 1 GET /wp-includes/sodium_compat/src/SodiumException.php 1 GET /wp-includes/sodium_compat/src/File.php 1 GET /wp-includes/sodium_compat/src/Crypto.php 1 GET /wp-includes/sodium_compat/src/Crypto32.php 1 GET /wp-includes/sodium_compat/src/Compat.php -- last 10 requests -- 85.204.70.92 - - [17/Aug/2026:19:29:42 +1000] "GET /wp-includes/sodium_compat/src/Crypto.php HTTP/1.1" 200 - "-" "-" 85.204.70.92 - - [17/Aug/2026:19:29:42 +1000] "GET /wp-includes/sodium_compat/src/Crypto32.php HTTP/1.1" 200 - "-" "-" 85.204.70.92 - - [17/Aug/2026:19:29:43 +1000] "GET /wp-includes/sodium_compat/src/File.php HTTP/1.1" 500 - "-" "-" 85.204.70.92 - - [17/Aug/2026:19:29:56 +1000] "GET /wp-includes/sodium_compat/src/SodiumException.php HTTP/1.1" 200 - "-" "-" 85.204.70.92 - - [17/Aug/2026:19:29:56 +1000] "GET /wp-includes/speculative-loading.php HTTP/1.1" 200 - "-" "-" 85.204.70.92 - - [17/Aug/2026:19:29:57 +1000] "GET /wp-includes/style-engine.php HTTP/1.1" 200 - "-" "-" 85.204.70.92 - - [17/Aug/2026:19:29:57 +1000] "GET /wp-includes/style-engine/ HTTP/1.1" 200 1717 "-" "-" 85.204.70.92 - - [17/Aug/2026:19:29:59 +1000] "GET /wp-includes/style-engine//wp-includes/ HTTP/1.1" 500 188 "-" "-" 85.204.70.92 - - [17/Aug/2026:19:30:02 +1000] "GET /wp-includes/style-engine/class-wp-style-engine-css-declarations.php HTTP/1.1" 200 - "-" "-" 85.204.70.92 - - [17/Aug/2026:19:30:03 +1000] "GET /wp-includes/style-engine/class-wp-style-engine-css-rule.php HTTP/1.1" 200 - "-" "-" --- last 30 samples (run-up to this incident) --- 2026-08-17 19:28:09 L1=0.86 run=2 blk=0 avail=6815 (58.1%) swpO=0 conn=2 myRSS=2416 php=1 phpRSS=132 ap=17 tcp=16 topuser=vinesit 2026-08-17 19:28:10 L1=0.86 run=3 blk=0 avail=6781 (57.8%) swpO=0 conn=3 myRSS=2416 php=2 phpRSS=196 ap=17 tcp=17 topuser=vinesit 2026-08-17 19:28:19 L1=0.88 run=2 blk=0 avail=6731 (57.4%) swpO=0 conn=2 myRSS=2416 php=2 phpRSS=257 ap=15 tcp=16 topuser=vinesit 2026-08-17 19:28:20 L1=0.88 run=1 blk=0 avail=6824 (58.2%) swpO=0 conn=3 myRSS=2416 php=1 phpRSS=133 ap=15 tcp=17 topuser=vinesit 2026-08-17 19:28:29 L1=0.82 run=1 blk=0 avail=6927 (59.1%) swpO=0 conn=1 myRSS=2416 php=0 phpRSS=0 ap=15 tcp=17 topuser=- 2026-08-17 19:28:30 L1=0.82 run=1 blk=0 avail=6926 (59.1%) swpO=0 conn=2 myRSS=2416 php=1 phpRSS=23 ap=15 tcp=18 topuser=evolution 2026-08-17 19:28:40 L1=0.94 run=1 blk=0 avail=6836 (58.3%) swpO=0 conn=1 myRSS=2416 php=0 phpRSS=0 ap=30 tcp=35 topuser=- 2026-08-17 19:28:40 L1=0.94 run=1 blk=0 avail=6821 (58.2%) swpO=0 conn=2 myRSS=2416 php=1 phpRSS=40 ap=30 tcp=36 topuser=evolution 2026-08-17 19:28:50 L1=0.87 run=1 blk=0 avail=6879 (58.7%) swpO=0 conn=1 myRSS=2416 php=0 phpRSS=0 ap=24 tcp=17 topuser=- 2026-08-17 19:28:50 L1=0.87 run=2 blk=0 avail=6867 (58.5%) swpO=0 conn=2 myRSS=2416 php=1 phpRSS=40 ap=24 tcp=18 topuser=evolution 2026-08-17 19:29:00 L1=0.81 run=1 blk=0 avail=6928 (59.1%) swpO=0 conn=1 myRSS=2416 php=0 phpRSS=0 ap=17 tcp=19 topuser=- 2026-08-17 19:29:00 L1=0.81 run=1 blk=0 avail=6916 (59.0%) swpO=0 conn=2 myRSS=2416 php=1 phpRSS=40 ap=17 tcp=20 topuser=evolution 2026-08-17 19:29:10 L1=0.84 run=2 blk=0 avail=6610 (56.4%) swpO=0 conn=1 myRSS=2416 php=2 phpRSS=373 ap=17 tcp=26 topuser=corpkicks 2026-08-17 19:29:10 L1=0.84 run=4 blk=0 avail=6559 (55.9%) swpO=0 conn=2 myRSS=2416 php=3 phpRSS=449 ap=17 tcp=26 topuser=corpkicks 2026-08-17 19:29:20 L1=0.87 run=2 blk=0 avail=6919 (59.0%) swpO=0 conn=1 myRSS=2416 php=1 phpRSS=39 ap=17 tcp=19 topuser=evolution 2026-08-17 19:29:20 L1=0.87 run=2 blk=0 avail=6912 (58.9%) swpO=0 conn=2 myRSS=2416 php=1 phpRSS=40 ap=17 tcp=19 topuser=evolution 2026-08-17 19:29:30 L1=0.97 run=3 blk=0 avail=6852 (58.4%) swpO=0 conn=3 myRSS=2416 php=2 phpRSS=143 ap=15 tcp=19 topuser=alison 2026-08-17 19:29:30 L1=0.97 run=3 blk=0 avail=6832 (58.3%) swpO=0 conn=3 myRSS=2416 php=2 phpRSS=162 ap=15 tcp=18 topuser=alison 2026-08-17 19:29:40 L1=1.13 run=2 blk=0 avail=6832 (58.2%) swpO=0 conn=3 myRSS=2416 php=2 phpRSS=157 ap=16 tcp=17 topuser=alison 2026-08-17 19:29:40 L1=1.13 run=3 blk=0 avail=6812 (58.1%) swpO=0 conn=3 myRSS=2416 php=2 phpRSS=177 ap=16 tcp=17 topuser=alison 2026-08-17 19:29:50 L1=1.27 run=3 blk=0 avail=6817 (58.1%) swpO=0 conn=3 myRSS=2416 php=2 phpRSS=175 ap=16 tcp=18 topuser=alison 2026-08-17 19:29:50 L1=1.27 run=3 blk=0 avail=6794 (57.9%) swpO=0 conn=3 myRSS=2416 php=2 phpRSS=195 ap=16 tcp=18 topuser=alison 2026-08-17 19:30:00 L1=1.39 run=2 blk=0 avail=6814 (58.1%) swpO=0 conn=3 myRSS=2416 php=2 phpRSS=175 ap=16 tcp=21 topuser=alison 2026-08-17 19:30:00 L1=1.39 run=2 blk=0 avail=6791 (57.9%) swpO=0 conn=3 myRSS=2416 php=2 phpRSS=194 ap=16 tcp=21 topuser=alison 2026-08-17 19:30:10 L1=1.57 run=4 blk=0 avail=6739 (57.5%) swpO=0 conn=3 myRSS=2416 php=4 phpRSS=301 ap=16 tcp=23 topuser=alison 2026-08-17 19:30:10 L1=1.57 run=3 blk=0 avail=6705 (57.2%) swpO=0 conn=3 myRSS=2416 php=4 phpRSS=339 ap=16 tcp=23 topuser=alison 2026-08-17 19:30:20 L1=1.64 run=2 blk=0 avail=6605 (56.3%) swpO=0 conn=3 myRSS=2417 php=3 phpRSS=210 ap=47 tcp=48 topuser=evolution 2026-08-17 19:30:20 L1=1.64 run=2 blk=0 avail=6590 (56.2%) swpO=0 conn=3 myRSS=2417 php=3 phpRSS=226 ap=47 tcp=47 topuser=alison 2026-08-17 19:30:30 L1=2.74 run=14 blk=0 avail=5701 (48.6%) swpO=763 conn=12 myRSS=2401 php=12 phpRSS=1514 ap=41 tcp=30 topuser=madalice 2026-08-17 19:30:30 L1=2.74 run=14 blk=0 avail=5541 (47.2%) swpO=763 conn=12 myRSS=2401 php=11 phpRSS=1401 ap=41 tcp=30 topuser=madalice