INCIDENT 2026-08-23 10:33:52 trigger: swapout=2369/s php_rss=2668MB mysql_conn=21 ================================================================== load: 2.04 2.20 1.60 26/710 2476677 ncpu:10 mem_avail: 4049MB/11729MB (34.5%) swap_used:3590MB swapout:2369/s blocked(D):0 running:28 iowait:1.1% steal:0.0% php: 24 procs / 2668MB heaviest user: alison (22 procs, 2588MB) apache: 80 procs tcp_estab: 43 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2670 alison 21 2412 root 242 982 nobody 79 948 netdata 8 260 mailnull 5 101 mailman 20 93 madalice 1 69 cpanellogin 1 63 corpkicks 1 43 dovenull 6 27 evolution 8 25 infinium 2 24 wp-toolkit 6 19 zabbix 1 14 named 1 12 kurri 1 10 nscd 1 7 dovecot 3 7 cpanelconnecttrack 1 3 --- php workers by user --- USER PROCS RSS_MB alison 19 2303 madalice 1 70 corpkicks 1 47 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 4680 MB Active(file): 2838 MB Inactive(file): 710 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 489 MB CommitLimit: 9960 MB Committed_AS: 10803 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 2136526 root 09:22:37 7072 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 2575700 1 mysql 2734400 9.8 Ssl 8-02:43:19 /usr/sbin/mariadbd 1220 1 netdata 206292 2.5 Ssl 55-00:24:01 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 2187119 2179066 root 191492 0.0 S 07:55:56 spamd child 2179066 1 root 176028 0.0 Ss 08:10:51 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 2187120 2179066 root 167364 0.0 S 07:55:56 spamd child 2476593 2476569 alison 161904 44.0 S 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2476591 2476570 alison 160060 43.3 S 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2476595 2476572 alison 159768 43.3 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2476596 2476573 alison 155796 44.6 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2476584 2476560 alison 147636 30.0 S 00:04 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2476594 2476567 alison 146296 38.6 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2476583 2476559 alison 141568 28.2 R 00:04 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2476585 2476561 alison 140108 37.6 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2476597 2476571 alison 133752 36.6 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2476640 2473715 alison 125940 45.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2476586 2476565 alison 117268 29.3 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2476587 2476563 alison 112460 28.0 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2476598 2476566 alison 110320 27.0 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2476635 2476605 alison 108228 25.6 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2476646 2473428 alison 102560 66.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2575382 1 root 97508 0.0 Ss 8-02:43:22 /usr/lib/systemd/systemd-journald 2476643 2469121 madalice 76612 18.0 R 00:02 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2476645 2473704 alison 73352 34.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2449607 1353308 cpanellogin 64876 0.0 S 39:45 /usr/local/cpanel/base/show_template.stor server_locale en default_login_theme cpanel docroot /usr/local/cpanel/base cpanel_locale 2476648 2463259 corpkicks 60500 15.0 R 00:01 /opt/cpanel/ea-php83/root/usr/bin/php-cgi 2223 1201 root 48236 0.0 Sl 55-00:24:00 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1353308 1 root 41984 0.0 Ss 32-07:52:31 cpsrvd (SSL) - waiting for connections 1469 1 root 41456 0.1 Ss 55-00:24:00 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 4922 2431 netdata 35712 0.1 Sl 55-00:23:56 /usr/libexec/netdata/plugins.d/go.d.plugin 1 2178228 1 root 30540 0.0 Ss 08:11:41 lfd - sleeping 1463 1 root 28092 0.0 Ss 55-00:24:00 tailwatchd 2111716 1 mailnull 25516 0.0 Ss 4-08:10:53 /usr/sbin/exim -ps -bd -q15m -oP /var/spool/exim/exim-daemon.pid 2476295 2111716 mailnull 25168 0.0 S 00:24 /usr/sbin/exim -ps -bd -q15m -oP /var/spool/exim/exim-daemon.pid 2476592 2476568 alison 24952 45.0 R 00:03 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2462322 1276780 nobody 22760 0.0 S 21:10 /usr/sbin/httpd -k start 2469121 1276780 nobody 22016 0.0 S 10:36 /usr/sbin/httpd -k start 2463259 1276780 nobody 21540 0.1 S 19:39 /usr/sbin/httpd -k start 2472854 1276780 nobody 20372 0.0 S 05:09 /usr/sbin/httpd -k start 2473708 1276780 nobody 20244 0.0 S 03:45 /usr/sbin/httpd -k start 2473707 1276780 nobody 20072 0.0 S 03:45 /usr/sbin/httpd -k start 2473715 1276780 nobody 19940 0.1 S 03:45 /usr/sbin/httpd -k start 2472211 1276780 nobody 19380 0.1 S 06:10 /usr/sbin/httpd -k start 2468988 1276780 nobody 19100 0.2 S 10:49 /usr/sbin/httpd -k start 2475022 1276780 nobody 18544 0.0 S 02:19 /usr/sbin/httpd -k start 2473428 1276780 nobody 18372 0.0 S 03:58 /usr/sbin/httpd -k start 185104 2431 netdata 17812 2.1 Sl 10-14:00:19 /usr/libexec/netdata/plugins.d/apps.plugin 1 2476426 2111716 mailnull 17788 0.0 S 00:12 /usr/sbin/exim -ps -bd -q15m -oP /var/spool/exim/exim-daemon.pid 2476526 2111716 mailnull 17788 0.0 S 00:06 /usr/sbin/exim -ps -bd -q15m -oP /var/spool/exim/exim-daemon.pid 2476642 2111716 mailnull 17788 0.0 S 00:02 /usr/sbin/exim -ps -bd -q15m -oP /var/spool/exim/exim-daemon.pid 2473704 1276780 nobody 17444 0.0 S 03:45 /usr/sbin/httpd -k start 2475021 1276780 nobody 17204 0.1 S 02:19 /usr/sbin/httpd -k start 1471 1 root 17044 0.0 Ss 55-00:24:00 cPhulkd - processor 2311424 1471 root 16804 0.0 S 04:26:40 cPhulkd - dbprocessor 2476565 1276780 nobody 15964 0.0 S 00:04 /usr/sbin/httpd -k start 2476569 1276780 nobody 15964 0.0 S 00:04 /usr/sbin/httpd -k start 2476508 1276780 nobody 15960 0.0 S 00:08 /usr/sbin/httpd -k start 2476524 1276780 nobody 15960 0.0 S 00:06 /usr/sbin/httpd -k start 2476536 1276780 nobody 15960 0.0 S 00:05 /usr/sbin/httpd -k start 2476570 1276780 nobody 15960 0.0 S 00:04 /usr/sbin/httpd -k start 2476571 1276780 nobody 15960 0.0 S 00:04 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- 2476643 D - /opt/cpanel/ea-php82/root/usr/bin/php-cgi 2476648 D - /opt/cpanel/ea-php83/root/usr/bin/php-cgi --- mariadb processlist (non-sleeping) --- +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 23275195 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +----------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min nrg/nrgservices.net.au-ssl_log 358 evolution/evolutionerp.com.au-ssl_log 340 cosgrovecreative/cosgrovecreative.com.au-ssl_log 138 alison/alisonarts.com.au-ssl_log 60 corpkicks/corporatekicks.com.au-ssl_log 52 coscom/coscom.com.au-ssl_log 45 bigdeals/bigdeals.com.au-ssl_log 42 madalice/madalice.com.au-ssl_log 31 evolution/evolutionerp.com.au 26 speedlin/speedlinefencing.com.au-ssl_log 6 evolution/my.evolutionerp.com.au-ssl_log 5 (total vhosts taking traffic: 11) --- top client IPs across all vhosts (last 3 min) --- 358 185.177.72.22 144 185.177.72.69 120 158.158.54.35 119 20.100.175.163 100 40.85.222.29 50 20.151.129.194 45 20.226.91.14 42 20.42.19.40 19 20.226.56.190 19 104.208.99.163 15 185.226.196.28 14 185.226.196.29 12 185.226.196.27 11 185.226.196.30 10 118.127.40.55 --- top request paths across all vhosts (last 3 min) --- 7 POST / 6 GET /1.php 5 GET /wp-login.php 5 GET /wp-content/plugins/hellopress/wp_filemanager.php 5 GET /aa.php 5 GET / 4 GET /wp-admin/js/index.php 4 GET /wp-admin/css/wp-login.php 4 GET /k.php 4 GET /av.php 4 GET /admin.php 3 POST /wp-cron.php 3 GET /x.php 3 GET /wp-includes/fonts/index.php 3 GET /wp-content/admin.php 3 GET /wp-admin/js/ 3 GET /wp-admin/ 3 GET /this_is_a_new_hello_world.php 3 GET /php.php 3 GET /m.php --- busiest 3 vhosts: top paths + last 10 requests --- == nrg/nrgservices.net.au-ssl_log == -- top paths -- 1 GET /wp-json/gravitysmtp/v1/tests/mock-data 1 GET /.well-known/stripe/ 1 GET /.well-known/acme-challenge/ 1 GET /website/.env.production 1 GET /website/.env.example 1 GET /website/.env 1 GET /website/config/.env 1 GET /.user.ini 1 GET /userdata/.env 1 GET /_test.php 1 GET /__test.php 1 GET /.terraformrc -- last 10 requests -- 185.177.72.22 - - [23/Aug/2026:10:33:17 +1000] "GET /billing/stripe.env HTTP/1.1" 403 12 "-" "curl/8.7.1" 185.177.72.22 - - [23/Aug/2026:10:33:18 +1000] "GET /bitbucket-pipelines.yml HTTP/1.1" 200 19 "-" "curl/8.7.1" 185.177.72.22 - - [23/Aug/2026:10:33:18 +1000] "GET /blog.env HTTP/1.1" 403 12 "-" "curl/8.7.1" 185.177.72.22 - - [23/Aug/2026:10:33:18 +1000] "GET /blog/.env HTTP/1.1" 403 12 "-" "curl/8.7.1" 185.177.72.22 - - [23/Aug/2026:10:33:19 +1000] "GET /blog/phpinfo.php HTTP/1.1" 403 12 "-" "curl/8.7.1" 185.177.72.22 - - [23/Aug/2026:10:33:19 +1000] "GET /blogs/.env HTTP/1.1" 403 12 "-" "curl/8.7.1" 185.177.72.22 - - [23/Aug/2026:10:33:19 +1000] "GET /bootstrap/email.php HTTP/1.1" 200 19 "-" "curl/8.7.1" 185.177.72.22 - - [23/Aug/2026:10:33:19 +1000] "GET /cart/.env HTTP/1.1" 403 12 "-" "curl/8.7.1" 185.177.72.22 - - [23/Aug/2026:10:33:20 +1000] "GET /cart/stripe.yaml HTTP/1.1" 200 19 "-" "curl/8.7.1" 185.177.72.22 - - [23/Aug/2026:10:33:20 +1000] "GET /cart/stripe.yml HTTP/1.1" 200 19 "-" "curl/8.7.1" == evolution/evolutionerp.com.au-ssl_log == -- top paths -- 4 GET /wp-login.php 2 POST /wp-cron.php 2 GET /wp-admin/js/index.php 2 GET /wp-admin/js/ 2 GET /wp-admin/css/wp-login.php 2 GET /wp-admin/ 2 GET /2.php 2 GET /1.php 1 GET /zup.php73 1 GET /x.php 1 GET /xleet.php 1 GET /xda.php -- last 10 requests -- 185.177.72.69 - - [23/Aug/2026:10:33:28 +1000] "GET /api/config/.env HTTP/1.1" 403 12 "-" "curl/8.7.1" 185.177.72.69 - - [23/Aug/2026:10:33:28 +1000] "GET /api/config/smtp.php HTTP/1.1" 404 120500 "-" "curl/8.7.1" 185.177.72.69 - - [23/Aug/2026:10:33:30 +1000] "GET /api/config/mail.php HTTP/1.1" 404 120500 "-" "curl/8.7.1" 185.177.72.69 - - [23/Aug/2026:10:33:31 +1000] "GET /api/config/email.php HTTP/1.1" 404 120501 "-" "curl/8.7.1" 185.177.72.69 - - [23/Aug/2026:10:33:33 +1000] "GET /api/config/services.php HTTP/1.1" 404 120504 "-" "curl/8.7.1" 185.177.72.69 - - [23/Aug/2026:10:33:35 +1000] "GET /api/config/mailer.yml HTTP/1.1" 404 120502 "-" "curl/8.7.1" 185.177.72.69 - - [23/Aug/2026:10:33:37 +1000] "GET /api/config/smtp.yml HTTP/1.1" 404 120500 "-" "curl/8.7.1" 185.177.72.69 - - [23/Aug/2026:10:33:38 +1000] "GET /api/config/email.yml HTTP/1.1" 404 120501 "-" "curl/8.7.1" 185.177.72.69 - - [23/Aug/2026:10:33:40 +1000] "GET /api/config/parameters.yml HTTP/1.1" 404 120506 "-" "curl/8.7.1" 185.177.72.69 - - [23/Aug/2026:10:33:42 +1000] "GET /api/config/database.php HTTP/1.1" 404 120504 "-" "curl/8.7.1" == cosgrovecreative/cosgrovecreative.com.au-ssl_log == -- top paths -- 2 GET /k.php 2 GET /av.php 2 GET /aa.php 1 GET /zup.php73 1 GET /x.php 1 GET /xleet.php 1 GET /xda.php 1 GET /ww5.php 1 GET /wso.php 1 GET /wsd.php 1 GET /ws83.php 1 GET /ws54.php -- last 10 requests -- 104.208.99.163 - - [23/Aug/2026:10:33:21 +1000] "GET /images.php HTTP/1.1" 404 5749 "-" "-" 104.208.99.163 - - [23/Aug/2026:10:33:22 +1000] "GET /ops.php HTTP/1.1" 404 5749 "-" "-" 104.208.99.163 - - [23/Aug/2026:10:33:22 +1000] "GET /coffexium.php HTTP/1.1" 404 5749 "-" "-" 104.208.99.163 - - [23/Aug/2026:10:33:22 +1000] "GET /BDKR28WP.php HTTP/1.1" 404 5749 "-" "-" 104.208.99.163 - - [23/Aug/2026:10:33:22 +1000] "GET /sf.php HTTP/1.1" 404 5749 "-" "-" 104.208.99.163 - - [23/Aug/2026:10:33:23 +1000] "GET /k.php?p= HTTP/1.1" 404 5749 "-" "-" 104.208.99.163 - - [23/Aug/2026:10:33:23 +1000] "GET /82.php HTTP/1.1" 404 5749 "-" "-" 104.208.99.163 - - [23/Aug/2026:10:33:23 +1000] "GET /dex.php HTTP/1.1" 404 5749 "-" "-" 104.208.99.163 - - [23/Aug/2026:10:33:23 +1000] "GET /inso.php HTTP/1.1" 404 5749 "-" "-" 104.208.99.163 - - [23/Aug/2026:10:33:24 +1000] "GET /aa.php HTTP/1.1" 404 5749 "-" "-" --- last 30 samples (run-up to this incident) --- 2026-08-23 10:31:24 L1=3.39 run=8 blk=0 avail=6108 (52.1%) swpO=0 conn=4 myRSS=2747 php=3 phpRSS=318 ap=22 tcp=37 topuser=evolution 2026-08-23 10:31:32 L1=3.41 run=3 blk=0 avail=6272 (53.5%) swpO=0 conn=4 myRSS=2747 php=2 phpRSS=154 ap=21 tcp=35 topuser=alison 2026-08-23 10:31:34 L1=3.41 run=5 blk=0 avail=6225 (53.1%) swpO=0 conn=4 myRSS=2747 php=1 phpRSS=91 ap=22 tcp=38 topuser=evolution 2026-08-23 10:31:42 L1=3.35 run=5 blk=0 avail=5872 (50.1%) swpO=0 conn=4 myRSS=2747 php=3 phpRSS=567 ap=25 tcp=30 topuser=madalice 2026-08-23 10:31:44 L1=3.35 run=2 blk=0 avail=6281 (53.6%) swpO=0 conn=2 myRSS=2747 php=1 phpRSS=100 ap=25 tcp=30 topuser=madalice 2026-08-23 10:31:52 L1=3.07 run=2 blk=0 avail=6242 (53.2%) swpO=0 conn=4 myRSS=2747 php=1 phpRSS=145 ap=23 tcp=31 topuser=evolution 2026-08-23 10:31:54 L1=3.07 run=5 blk=0 avail=5913 (50.4%) swpO=0 conn=2 myRSS=2747 php=4 phpRSS=609 ap=23 tcp=34 topuser=evolution 2026-08-23 10:32:02 L1=3.05 run=3 blk=0 avail=6179 (52.7%) swpO=0 conn=4 myRSS=2747 php=2 phpRSS=275 ap=23 tcp=36 topuser=evolution 2026-08-23 10:32:04 L1=3.05 run=3 blk=0 avail=6259 (53.4%) swpO=0 conn=2 myRSS=2747 php=2 phpRSS=196 ap=23 tcp=36 topuser=tubesupplies 2026-08-23 10:32:12 L1=2.73 run=3 blk=0 avail=6335 (54.0%) swpO=2 conn=4 myRSS=2747 php=2 phpRSS=136 ap=22 tcp=30 topuser=evolution 2026-08-23 10:32:14 L1=2.73 run=4 blk=0 avail=6170 (52.6%) swpO=2 conn=2 myRSS=2747 php=3 phpRSS=334 ap=21 tcp=35 topuser=alison 2026-08-23 10:32:22 L1=2.69 run=2 blk=0 avail=6408 (54.6%) swpO=2 conn=2 myRSS=2746 php=1 phpRSS=36 ap=21 tcp=33 topuser=evolution 2026-08-23 10:32:24 L1=2.55 run=2 blk=0 avail=6349 (54.1%) swpO=2 conn=2 myRSS=2746 php=1 phpRSS=97 ap=21 tcp=29 topuser=evolution 2026-08-23 10:32:32 L1=2.43 run=1 blk=0 avail=6426 (54.8%) swpO=0 conn=2 myRSS=2746 php=0 phpRSS=0 ap=20 tcp=26 topuser=- 2026-08-23 10:32:34 L1=2.48 run=4 blk=0 avail=6229 (53.1%) swpO=0 conn=2 myRSS=2746 php=3 phpRSS=290 ap=19 tcp=26 topuser=evolution 2026-08-23 10:32:42 L1=2.28 run=5 blk=0 avail=5877 (50.1%) swpO=0 conn=2 myRSS=2746 php=5 phpRSS=694 ap=20 tcp=37 topuser=alison 2026-08-23 10:32:44 L1=2.09 run=1 blk=0 avail=6412 (54.7%) swpO=0 conn=1 myRSS=2747 php=0 phpRSS=0 ap=20 tcp=32 topuser=- 2026-08-23 10:32:52 L1=2.25 run=3 blk=0 avail=6249 (53.3%) swpO=0 conn=2 myRSS=2747 php=2 phpRSS=230 ap=20 tcp=26 topuser=evolution 2026-08-23 10:32:54 L1=2.07 run=1 blk=0 avail=6420 (54.7%) swpO=0 conn=1 myRSS=2747 php=0 phpRSS=0 ap=20 tcp=28 topuser=- 2026-08-23 10:33:02 L1=2.06 run=5 blk=0 avail=6173 (52.6%) swpO=0 conn=2 myRSS=2747 php=3 phpRSS=334 ap=20 tcp=30 topuser=corpkicks 2026-08-23 10:33:04 L1=2.06 run=5 blk=0 avail=6145 (52.4%) swpO=0 conn=1 myRSS=2747 php=2 phpRSS=220 ap=20 tcp=27 topuser=evolution 2026-08-23 10:33:12 L1=1.97 run=2 blk=0 avail=6357 (54.2%) swpO=0 conn=2 myRSS=2747 php=1 phpRSS=101 ap=19 tcp=27 topuser=alison 2026-08-23 10:33:14 L1=1.81 run=1 blk=0 avail=6422 (54.8%) swpO=0 conn=1 myRSS=2747 php=0 phpRSS=0 ap=19 tcp=30 topuser=- 2026-08-23 10:33:22 L1=1.75 run=1 blk=0 avail=6431 (54.8%) swpO=2 conn=1 myRSS=2746 php=0 phpRSS=0 ap=19 tcp=31 topuser=- 2026-08-23 10:33:24 L1=1.61 run=1 blk=0 avail=6434 (54.9%) swpO=2 conn=1 myRSS=2746 php=0 phpRSS=0 ap=19 tcp=29 topuser=- 2026-08-23 10:33:32 L1=1.56 run=2 blk=0 avail=6272 (53.5%) swpO=3 conn=1 myRSS=2746 php=1 phpRSS=48 ap=19 tcp=35 topuser=evolution 2026-08-23 10:33:34 L1=1.43 run=2 blk=0 avail=6427 (54.8%) swpO=3 conn=1 myRSS=2746 php=0 phpRSS=0 ap=19 tcp=34 topuser=- 2026-08-23 10:33:42 L1=1.48 run=2 blk=0 avail=6285 (53.6%) swpO=0 conn=1 myRSS=2746 php=1 phpRSS=174 ap=18 tcp=31 topuser=evolution 2026-08-23 10:33:45 L1=1.52 run=1 blk=0 avail=6438 (54.9%) swpO=0 conn=1 myRSS=2746 php=0 phpRSS=0 ap=18 tcp=30 topuser=- 2026-08-23 10:33:52 L1=2.04 run=28 blk=0 avail=4049 (34.5%) swpO=2369 conn=21 myRSS=2670 php=24 phpRSS=2668 ap=80 tcp=43 topuser=alison