INCIDENT 2026-08-22 22:17:03 trigger: swapout=2685/s ================================================================== load: 1.02 0.69 0.64 2/629 2033691 ncpu:10 mem_avail: 3905MB/11729MB (33.3%) swap_used:3477MB swapout:2685/s blocked(D):3 running:4 iowait:6.7% steal:0.0% php: 1 procs / 114MB heaviest user: evolution (1 procs, 114MB) apache: 13 procs tcp_estab: 26 --- RSS by user (all processes) --- USER PROCS RSS_MB evolution 12 2925 mysql 1 2558 root 244 772 netdata 8 249 nobody 12 204 mailman 20 92 cpanellogin 1 76 dovenull 6 26 lowrange 2 25 wp-toolkit 6 20 mailnull 3 20 zabbix 1 15 named 1 12 candyfabcom 1 12 alison 1 12 kurri 1 10 nscd 1 7 dovecot 3 7 cpanelconnecttrack 1 3 dbus 1 2 --- php workers by user --- USER PROCS RSS_MB evolution 1 115 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 3632 MB Active(file): 1677 MB Inactive(file): 1927 MB Dirty: 17 MB Writeback: 0 MB SReclaimable: 445 MB CommitLimit: 9960 MB Committed_AS: 9295 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 1297509 root 21:05:47 2412 /usr/bin/imunify-agent-proxy 2030161 root 05:55 58084 /opt/imunify360/venv/bin/python3 -m imav.run --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2033530 2033529 evolution 2818672 96.5 RNs 00:16 /usr/local/cpanel/3rdparty/bin/analog +CIMAGEDIR /images/ +CDOMAINSFILE /usr/local/cpanel/3rdparty/share/analog/usdom.tab +CCHARTDIR ./ 2575700 1 mysql 2620016 10.3 Ssl 7-14:26:28 /usr/sbin/mariadbd 1220 1 netdata 197532 2.5 Ssl 54-12:07:10 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 1353014 1343371 root 167944 0.0 S 19:38:41 spamd child 2033620 2031481 evolution 119148 13.5 D 00:04 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 1967987 1353308 cpanellogin 78568 0.0 S 01:54:38 /usr/local/cpanel/base/show_template.stor default_login_theme cpanel server_locale en docroot /usr/local/cpanel/base cpanel_locale 1343371 1 root 77280 0.0 Ss 19:53:40 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 1846716 1343371 root 71560 0.0 S 05:35:22 spamd child 2030161 1 root 58084 0.4 Ssl 05:55 /opt/imunify360/venv/bin/python3 -m imav.run 2223 1201 root 53092 0.0 Sl 54-12:07:09 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1353308 1 root 42664 0.0 Ss 31-19:35:40 cpsrvd (SSL) - waiting for connections 2575382 1 root 37576 0.0 Ss 7-14:26:31 /usr/lib/systemd/systemd-journald 2032094 2111368 root 33288 0.7 SN 02:00 cpanellogd - waiting for child to process logs for evolution 4922 2431 netdata 32944 0.1 Sl 54-12:07:05 /usr/libexec/netdata/plugins.d/go.d.plugin 1 1469 1 root 31764 0.1 Ss 54-12:07:09 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 2033479 2032094 evolution 31532 0.2 SN 00:21 cpanellogd - http logs for evolution 1342210 1 root 22596 0.0 Ss 19:54:40 lfd - sleeping 2027788 1276780 nobody 22468 0.0 S 10:18 /usr/sbin/httpd -k start 2027800 1276780 nobody 22360 0.0 S 10:15 /usr/sbin/httpd -k start 2027803 1276780 nobody 22256 0.0 S 10:15 /usr/sbin/httpd -k start 1463 1 root 22056 0.0 Ss 54-12:07:09 tailwatchd 2025721 1276780 nobody 21260 0.0 S 14:14 /usr/sbin/httpd -k start 2029576 1276780 nobody 20712 0.0 S 06:38 /usr/sbin/httpd -k start 2031021 1276780 nobody 20080 0.0 S 04:13 /usr/sbin/httpd -k start 2031059 1276780 nobody 20004 0.0 S 04:08 /usr/sbin/httpd -k start 2031016 1276780 nobody 19492 0.0 S 04:14 /usr/sbin/httpd -k start 2031547 1276780 nobody 19004 0.0 S 02:59 /usr/sbin/httpd -k start 185104 2431 netdata 17844 2.1 Sl 10-01:43:28 /usr/libexec/netdata/plugins.d/apps.plugin 1 2031481 1276780 nobody 17712 0.0 S 03:05 /usr/sbin/httpd -k start 1204 1 zabbix 16348 0.2 Ssl 54-12:07:10 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 1471 1 root 14524 0.0 Ss 54-12:07:09 cPhulkd - processor 2033554 1471 root 14300 0.0 S 00:12 cPhulkd - processor - http socket 1591218 1471 root 14252 0.0 S 13:14:59 cPhulkd - dbprocessor 2014757 3828812 lowrange 13004 0.0 S 33:20 dovecot/imap 2019213 3828812 alison 12940 0.0 S 26:01 dovecot/imap 2107664 1 named 12812 0.0 Ssl 3-19:54:24 /usr/sbin/pdns_server --socket-dir=/run/pdns --guardian=no --daemon=no --disable-syslog --log-timestamp=no --write-pid=no 2029117 3828812 lowrange 12652 0.0 S 07:33 dovecot/imap 2033581 3828812 candyfabcom 12316 0.0 S 00:10 dovecot/imap 1276780 1 root 11244 0.0 Ss 17-06:45:45 /usr/sbin/httpd -k start 2028246 3828812 root 10964 0.0 S 09:22 dovecot/auth -w 3668761 3828812 kurri 10808 0.0 S 2-12:02:49 dovecot/imap 2107879 1 root 9744 0.0 Ss 3-19:54:23 queueprocd - waiting up to 60s to process a task 2032761 2111716 mailnull 8256 0.0 S 01:09 /usr/sbin/exim -ps -bd -q15m -oP /var/spool/exim/exim-daemon.pid 2033582 2111716 mailnull 8108 0.0 S 00:08 /usr/sbin/exim -ps -bd -q15m -oP /var/spool/exim/exim-daemon.pid 1059098 3828812 dovenull 8056 0.0 S 9-06:44:15 dovecot/imap-login 1466 1 root 7668 0.0 Ss 54-12:07:09 dnsadmin - dormant mode 1059102 3828812 dovenull 7568 0.0 S 9-06:44:15 dovecot/imap-login 918817 27524 root 7492 0.0 Ss 1-07:03:06 sshd: evolution [priv] 2111078 1 nscd 7340 0.0 Ssl 3-19:54:13 /usr/sbin/nscd 4028163 27524 root 6380 0.0 Ss 2-06:57:27 sshd: evolution [priv] 1 0 root 6232 0.2 Ss 54-12:07:18 /usr/lib/systemd/systemd --switched-root --system --deserialize 17 1574 1 wp-toolkit 6212 0.0 Ss 54-12:07:09 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 1667290 2431 netdata 6128 0.0 Sl 11:03:31 /usr/libexec/netdata/plugins.d/debugfs.plugin 1 1578 1 wp-toolkit 5952 0.0 Ss 54-12:07:09 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php 4028165 27524 root 5876 0.0 Ss 2-06:57:27 sshd: root [priv] 1059104 3828812 dovenull 5872 0.0 S 9-06:44:15 dovecot/pop3-login 4161699 27524 root 5840 0.0 Ss 2-04:29:23 sshd: evolution [priv] 1059100 3828812 dovenull 5728 0.0 S 9-06:44:15 dovecot/pop3-login 906072 1 evolution 5456 0.0 Ss 4-22:20:30 /usr/lib/systemd/systemd --user 2111825 2111790 mailman 5288 0.0 S 3-19:54:01 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=RetryRunner:0:1 -s --- processes in D state (uninterruptible IO) --- 2033620 D - /opt/cpanel/ea-php81/root/usr/bin/php-cgi --- mariadb processlist (non-sleeping) --- +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 23197199 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min madalice/madalice.com.au-ssl_log 115 kamcool/kamcool.com.au-ssl_log 37 (total vhosts taking traffic: 2) --- top client IPs across all vhosts (last 3 min) --- 96 4.204.200.136 37 20.251.63.238 13 20.151.9.151 2 114.119.143.14 1 66.249.73.161 1 129.153.87.139 1 114.119.146.16 1 114.119.137.101 --- top request paths across all vhosts (last 3 min) --- 37 GET /autodiscover/autodiscover.xml 4 GET /store/leopard-print-custom-kids-kicks/ 2 GET /wp-content/plugins/hellopress/wp_filemanager.php 2 GET /this_is_a_new_hello_world.php 2 GET /admin.php 2 GET /about.php 2 GET /aaa.php 1 GET /zip.php 1 GET /yj09.php 1 GET /xiugai.php 1 GET /wp-ws68.php 1 GET /wp-load.php 1 GET /wp-includes/Text/ 1 GET //wp-includes/Requests/ 1 GET //wp-includes/l10n/ 1 GET //wp-includes/js/jquery/ 1 GET /wp-includes/ID3/about.php 1 GET //wp-includes/css/dist/ 1 GET /wp-includes/blocks/details/ 1 GET //wp-includes/assets/ --- busiest 3 vhosts: top paths + last 10 requests --- == madalice/madalice.com.au-ssl_log == -- top paths -- 4 GET /store/leopard-print-custom-kids-kicks/ 2 GET /wp-content/plugins/hellopress/wp_filemanager.php 2 GET /this_is_a_new_hello_world.php 2 GET /admin.php 2 GET /about.php 2 GET /aaa.php 1 GET /zip.php 1 GET /yj09.php 1 GET /xiugai.php 1 GET /wp-ws68.php 1 GET /wp-load.php 1 GET /wp-includes/Text/ -- last 10 requests -- 20.151.9.151 - - [22/Aug/2026:22:16:59 +1000] "GET /conf.php HTTP/1.1" 404 3417 "-" "-" 20.151.9.151 - - [22/Aug/2026:22:16:59 +1000] "GET /db.php HTTP/1.1" 404 3417 "-" "-" 20.151.9.151 - - [22/Aug/2026:22:17:00 +1000] "GET /ffile.php HTTP/1.1" 404 3417 "-" "-" 20.151.9.151 - - [22/Aug/2026:22:17:00 +1000] "GET /ff123.php HTTP/1.1" 404 3417 "-" "-" 20.151.9.151 - - [22/Aug/2026:22:17:00 +1000] "GET /a.php HTTP/1.1" 404 3417 "-" "-" 20.151.9.151 - - [22/Aug/2026:22:17:00 +1000] "GET /acces.php HTTP/1.1" 404 3417 "-" "-" 20.151.9.151 - - [22/Aug/2026:22:17:01 +1000] "GET /Sanskrit.php HTTP/1.1" 404 3417 "-" "-" 20.151.9.151 - - [22/Aug/2026:22:17:01 +1000] "GET /133.php HTTP/1.1" 404 3417 "-" "-" 20.151.9.151 - - [22/Aug/2026:22:17:01 +1000] "GET /reune.php HTTP/1.1" 404 3417 "-" "-" 20.151.9.151 - - [22/Aug/2026:22:17:01 +1000] "GET /pol.php HTTP/1.1" 404 3417 "-" "-" == kamcool/kamcool.com.au-ssl_log == -- top paths -- 37 GET /autodiscover/autodiscover.xml -- last 10 requests -- 20.251.63.238 - - [22/Aug/2026:22:15:45 +1000] "GET /autodiscover/autodiscover.xml HTTP/1.1" 400 52 "-" "-" 20.251.63.238 - - [22/Aug/2026:22:15:47 +1000] "GET /autodiscover/autodiscover.xml HTTP/1.1" 400 52 "-" "-" 20.251.63.238 - - [22/Aug/2026:22:15:49 +1000] "GET /autodiscover/autodiscover.xml HTTP/1.1" 400 52 "-" "-" 20.251.63.238 - - [22/Aug/2026:22:15:50 +1000] "GET /autodiscover/autodiscover.xml HTTP/1.1" 400 52 "-" "-" 20.251.63.238 - - [22/Aug/2026:22:15:52 +1000] "GET /autodiscover/autodiscover.xml HTTP/1.1" 400 52 "-" "-" 20.251.63.238 - - [22/Aug/2026:22:15:54 +1000] "GET /autodiscover/autodiscover.xml HTTP/1.1" 400 52 "-" "-" 20.251.63.238 - - [22/Aug/2026:22:15:55 +1000] "GET /autodiscover/autodiscover.xml HTTP/1.1" 400 52 "-" "-" 20.251.63.238 - - [22/Aug/2026:22:15:57 +1000] "GET /autodiscover/autodiscover.xml HTTP/1.1" 400 52 "-" "-" 20.251.63.238 - - [22/Aug/2026:22:15:58 +1000] "GET /autodiscover/autodiscover.xml HTTP/1.1" 400 52 "-" "-" 20.251.63.238 - - [22/Aug/2026:22:15:59 +1000] "GET /autodiscover/autodiscover.xml HTTP/1.1" 400 52 "-" "-" --- last 30 samples (run-up to this incident) --- 2026-08-22 22:14:37 L1=0.37 run=1 blk=0 avail=6573 (56.0%) swpO=0 conn=1 myRSS=2651 php=0 phpRSS=0 ap=14 tcp=22 topuser=- 2026-08-22 22:14:42 L1=0.42 run=1 blk=0 avail=6570 (56.0%) swpO=0 conn=1 myRSS=2651 php=0 phpRSS=0 ap=14 tcp=23 topuser=- 2026-08-22 22:14:47 L1=0.39 run=1 blk=0 avail=6571 (56.0%) swpO=0 conn=1 myRSS=2651 php=0 phpRSS=0 ap=14 tcp=24 topuser=- 2026-08-22 22:14:52 L1=0.44 run=2 blk=0 avail=6423 (54.8%) swpO=0 conn=1 myRSS=2651 php=1 phpRSS=185 ap=14 tcp=22 topuser=madalice 2026-08-22 22:14:57 L1=0.40 run=1 blk=0 avail=6576 (56.1%) swpO=0 conn=1 myRSS=2651 php=0 phpRSS=0 ap=14 tcp=23 topuser=- 2026-08-22 22:15:02 L1=0.53 run=1 blk=0 avail=6523 (55.6%) swpO=0 conn=1 myRSS=2651 php=1 phpRSS=69 ap=14 tcp=24 topuser=evolution 2026-08-22 22:15:07 L1=0.57 run=1 blk=0 avail=6261 (53.4%) swpO=0 conn=1 myRSS=2651 php=2 phpRSS=330 ap=14 tcp=22 topuser=corpkicks 2026-08-22 22:15:13 L1=0.76 run=4 blk=0 avail=6010 (51.2%) swpO=0 conn=3 myRSS=2651 php=2 phpRSS=201 ap=14 tcp=22 topuser=madalice 2026-08-22 22:15:17 L1=0.70 run=4 blk=0 avail=6488 (55.3%) swpO=0 conn=1 myRSS=2651 php=1 phpRSS=69 ap=14 tcp=23 topuser=evolution 2026-08-22 22:15:23 L1=0.73 run=2 blk=0 avail=6398 (54.6%) swpO=0 conn=3 myRSS=2651 php=1 phpRSS=69 ap=14 tcp=23 topuser=evolution 2026-08-22 22:15:27 L1=0.75 run=3 blk=0 avail=6402 (54.6%) swpO=0 conn=1 myRSS=2651 php=1 phpRSS=52 ap=14 tcp=22 topuser=corpkicks 2026-08-22 22:15:33 L1=0.77 run=2 blk=0 avail=5842 (49.8%) swpO=352 conn=3 myRSS=2642 php=0 phpRSS=0 ap=14 tcp=21 topuser=- 2026-08-22 22:15:37 L1=0.87 run=2 blk=0 avail=6531 (55.7%) swpO=352 conn=1 myRSS=2642 php=0 phpRSS=0 ap=14 tcp=21 topuser=- 2026-08-22 22:15:43 L1=0.80 run=3 blk=0 avail=6467 (55.1%) swpO=0 conn=3 myRSS=2642 php=1 phpRSS=88 ap=14 tcp=28 topuser=alison 2026-08-22 22:15:47 L1=0.97 run=3 blk=0 avail=6520 (55.6%) swpO=0 conn=1 myRSS=2642 php=0 phpRSS=0 ap=14 tcp=25 topuser=- 2026-08-22 22:15:53 L1=0.98 run=1 blk=0 avail=6524 (55.6%) swpO=0 conn=3 myRSS=2642 php=0 phpRSS=0 ap=14 tcp=22 topuser=- 2026-08-22 22:15:57 L1=0.98 run=1 blk=0 avail=6517 (55.6%) swpO=0 conn=1 myRSS=2642 php=0 phpRSS=0 ap=14 tcp=23 topuser=- 2026-08-22 22:16:03 L1=0.98 run=2 blk=1 avail=6524 (55.6%) swpO=0 conn=3 myRSS=2642 php=0 phpRSS=0 ap=14 tcp=26 topuser=- 2026-08-22 22:16:07 L1=0.98 run=3 blk=0 avail=6475 (55.2%) swpO=0 conn=1 myRSS=2642 php=1 phpRSS=79 ap=14 tcp=28 topuser=madalice 2026-08-22 22:16:13 L1=0.98 run=2 blk=0 avail=6363 (54.2%) swpO=0 conn=2 myRSS=2642 php=1 phpRSS=197 ap=14 tcp=28 topuser=madalice 2026-08-22 22:16:18 L1=0.90 run=2 blk=0 avail=6532 (55.7%) swpO=0 conn=1 myRSS=2642 php=0 phpRSS=0 ap=14 tcp=25 topuser=- 2026-08-22 22:16:23 L1=0.91 run=3 blk=0 avail=6534 (55.7%) swpO=0 conn=2 myRSS=2642 php=0 phpRSS=0 ap=14 tcp=25 topuser=- 2026-08-22 22:16:28 L1=1.00 run=2 blk=0 avail=6297 (53.7%) swpO=0 conn=1 myRSS=2642 php=1 phpRSS=264 ap=14 tcp=25 topuser=corpkicks 2026-08-22 22:16:33 L1=0.92 run=1 blk=0 avail=6557 (55.9%) swpO=0 conn=2 myRSS=2642 php=0 phpRSS=0 ap=14 tcp=22 topuser=- 2026-08-22 22:16:38 L1=1.01 run=1 blk=0 avail=6558 (55.9%) swpO=0 conn=1 myRSS=2642 php=0 phpRSS=0 ap=13 tcp=22 topuser=- 2026-08-22 22:16:43 L1=1.01 run=2 blk=0 avail=6492 (55.3%) swpO=0 conn=2 myRSS=2642 php=0 phpRSS=0 ap=13 tcp=26 topuser=- 2026-08-22 22:16:48 L1=0.93 run=2 blk=0 avail=6492 (55.3%) swpO=0 conn=1 myRSS=2642 php=0 phpRSS=0 ap=13 tcp=19 topuser=- 2026-08-22 22:16:53 L1=0.93 run=2 blk=0 avail=5104 (43.5%) swpO=686 conn=2 myRSS=2631 php=0 phpRSS=0 ap=13 tcp=20 topuser=- 2026-08-22 22:16:58 L1=0.94 run=3 blk=0 avail=3886 (33.1%) swpO=1590 conn=1 myRSS=2608 php=0 phpRSS=0 ap=13 tcp=20 topuser=- 2026-08-22 22:17:03 L1=1.02 run=4 blk=3 avail=3905 (33.3%) swpO=2685 conn=2 myRSS=2558 php=1 phpRSS=114 ap=13 tcp=26 topuser=evolution