INCIDENT 2026-08-28 21:37:18 trigger: php_rss=1676MB ================================================================== load: 1.76 0.93 0.89 4/628 455428 ncpu:10 mem_avail: 7467MB/13777MB (54.2%) swap_used:971MB swapout:0/s blocked(D):0 running:4 iowait:0.1% steal:0.0% php: 15 procs / 1676MB heaviest user: madalice (10 procs, 1391MB) apache: 32 procs tcp_estab: 41 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2574 madalice 10 1391 root 258 1148 nobody 31 522 mailman 20 335 netdata 7 208 aaa 2 111 cpanellogin 1 108 speedlin 1 107 infinium 3 104 wp-toolkit 3 83 evolution 8 80 dovenull 6 59 lowrange 2 33 zabbix 1 25 mailnull 2 25 dovecot 3 24 named 1 23 vinesit 1 14 corpkicks 1 14 --- php workers by user --- USER PROCS RSS_MB madalice 10 1391 speedlin 1 109 aaa 1 64 evolution 2 61 root 1 25 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5582 MB Active(file): 5039 MB Inactive(file): 779 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 632 MB CommitLimit: 10984 MB Committed_AS: 8655 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 489033 root 19:18:38 11384 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 506671 1 mysql 2635968 14.8 Ssl 19:18:07 /usr/sbin/mariadbd 529389 527476 root 186728 0.0 S 19:13:00 spamd child 508924 1 netdata 183460 2.0 Ssl 19:17:36 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 454509 510022 madalice 163036 14.6 S 00:35 php-fpm: pool madalice_com_au 453393 510022 madalice 159864 15.6 S 01:35 php-fpm: pool madalice_com_au 455312 510022 madalice 139988 33.5 S 00:04 php-fpm: pool madalice_com_au 455306 510022 madalice 139980 35.5 S 00:04 php-fpm: pool madalice_com_au 455307 510022 madalice 139968 36.2 S 00:04 php-fpm: pool madalice_com_au 455328 510022 madalice 136828 45.6 S 00:03 php-fpm: pool madalice_com_au 455329 510022 madalice 136412 45.3 S 00:03 php-fpm: pool madalice_com_au 455318 510022 madalice 136408 35.5 S 00:04 php-fpm: pool madalice_com_au 455321 510022 madalice 136408 33.2 S 00:04 php-fpm: pool madalice_com_au 455338 510022 madalice 136404 46.0 S 00:03 php-fpm: pool madalice_com_au 455384 437009 speedlin 116460 86.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 4074469 1353308 cpanellogin 111228 0.0 S 02:47:53 /usr/local/cpanel/base/show_template.stor server_locale en default_login_theme cpanel cpanel_locale docroot /usr/local/cpanel/base 527476 1 root 93032 0.0 Ss 19:14:39 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 2985227 527476 root 88212 0.0 S 07:58:37 spamd child 509266 1 root 63576 0.0 Ss 19:17:33 /usr/lib/systemd/systemd-journald 509236 509098 root 62936 0.0 Sl 19:17:33 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 454564 1353308 infinium 54752 0.4 S 00:31 webmaild - serving 1.41.252.211 938582 1 wp-toolkit 48920 0.0 Ss 17:25:10 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 1353308 1 root 41452 0.1 Ss 37-18:55:59 cpsrvd (SSL) - waiting for connections 455396 437038 evolution 40620 0.0 S 00:00 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 455397 1469 root 33284 0.0 S 00:00 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 422130 938407 infinium 32924 0.1 S 07:36 php-fpm: pool user_infinium 455398 1469 root 32924 0.0 S 00:00 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 455394 1469 root 32920 0.0 S 00:00 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 455395 1469 root 32920 0.0 S 00:00 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 455461 1469 root 32908 0.0 R 00:00 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 938585 1 wp-toolkit 32324 0.0 Ss 17:25:10 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php 1469 1 root 30008 0.1 Ss 60-11:27:28 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 526869 1 root 29752 0.0 Ss 19:15:02 lfd - sleeping 509640 508992 root 27052 0.0 Sl 19:17:31 /usr/libexec/netdata/plugins.d/ebpf.plugin 1 510022 1 root 26304 0.0 Ss 19:17:29 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 483898 1 zabbix 25880 0.2 Ssl 19:18:50 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 1466 1 root 25772 0.0 Ss 60-11:27:28 dnsadmin - server mode 481558 1 root 24364 0.1 Ssl 19:20:00 /usr/libexec/platform-python -Es /usr/sbin/tuned -l -P 508634 1 named 23936 0.0 Ssl 19:17:41 /usr/sbin/pdns_server --socket-dir=/run/pdns --guardian=no --daemon=no --disable-syslog --log-timestamp=no --write-pid=no 421831 506832 nobody 23436 0.0 S 08:03 /usr/sbin/httpd -k start 1463 1 root 22800 0.0 Ss 60-11:27:28 tailwatchd 421879 506832 nobody 22732 0.0 S 08:00 /usr/sbin/httpd -k start 437009 506832 nobody 22664 0.0 S 05:27 /usr/sbin/httpd -k start 4180059 4180015 evolution 22452 0.0 Ss 21:37:18 /opt/cpanel/ea-php74/root/usr/bin/php-cgi /home/evolution/my.evolutionerp.com.au/cron/xero2.php 370178 508511 lowrange 22420 0.0 S 25:47 dovecot/imap 437037 506832 nobody 22272 0.1 S 05:25 /usr/sbin/httpd -k start 436633 506832 nobody 21824 0.0 S 06:02 /usr/sbin/httpd -k start 438443 506832 nobody 21692 0.1 S 03:06 /usr/sbin/httpd -k start 437048 506832 nobody 21612 0.0 S 05:24 /usr/sbin/httpd -k start 453476 506832 nobody 21052 0.0 S 01:30 /usr/sbin/httpd -k start 453414 506832 nobody 20752 0.0 S 01:33 /usr/sbin/httpd -k start 437038 506832 nobody 20404 0.0 S 05:25 /usr/sbin/httpd -k start 452988 506832 nobody 20372 0.1 S 01:59 /usr/sbin/httpd -k start 437718 506832 nobody 20308 0.0 S 04:27 /usr/sbin/httpd -k start 436628 506832 nobody 19328 0.0 S 06:03 /usr/sbin/httpd -k start 454382 506832 nobody 19216 0.0 S 00:40 /usr/sbin/httpd -k start 370183 508511 infinium 19032 0.0 S 25:47 dovecot/imap 508855 508814 mailman 19008 0.0 S 19:17:39 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=IncomingRunner:2:4 -s 508865 508814 mailman 19008 0.0 S 19:17:39 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:7:8 -s 508856 508814 mailman 18668 0.0 S 19:17:39 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=IncomingRunner:3:4 -s 508864 508814 mailman 18652 0.0 S 19:17:39 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:6:8 -s --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+-------------+-------------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+-------------+-------------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 3687394 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | | 3687388 | speedlin_wp | speedlin_wp | Query | 0 | Writing to net | SELECT option_value FROM w50Gr_options WHERE option_name = 'loginizer_ip_method' LIMIT 1 | +---------+-------------+-------------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min alison/alisonarts.com.au-ssl_log 277 tubesupplies/tubesupplies.com.au-ssl_log 250 speedlin/speedlinefencing.com.au-ssl_log 173 kurri/kurrimotorinn.com.au-ssl_log 91 infinium/infinium.net.au-ssl_log 84 infinium/infinium.net.au 43 madalice/madalice.com.au-ssl_log 22 evolution/portal.evolutionerp.com.au-ssl_log 18 evolution/my.evolutionerp.com.au-ssl_log 4 aaa/aaadownunder.com.au-ssl_log 3 (total vhosts taking traffic: 10) --- top client IPs across all vhosts (last 3 min) --- 368 4.205.62.107 245 185.177.72.11 104 4.232.148.111 102 20.151.129.194 91 20.104.18.15 18 203.54.180.238 5 118.127.40.55 3 40.77.167.116 2 91.92.243.249 2 91.92.243.243 2 114.119.131.88 1 91.92.243.246 1 66.249.73.165 1 54.156.55.147 1 52.54.15.103 --- top request paths across all vhosts (last 3 min) --- 18 GET /heartbeat.php 6 GET /radio.php 5 POST /wp-login.php 5 POST /wp-cron.php 5 GET /goods.php 4 GET /xda.php 4 GET /wp-content/plugins/hellopress/wp_filemanager.php 4 GET /tinyfilemanager.php 4 GET /this_is_a_new_hello_world.php 4 GET /store/hand-painted-af1-drippy-kids/ 4 GET /session.php 4 GET /ms-edit.php 4 GET /index.php 4 GET /admin.php 3 GET /w.php 3 GET /wp-access.php 3 GET /ty.php 3 GET /themes.php 3 GET /test.php 3 GET /tax.php --- busiest 3 vhosts: top paths + last 10 requests --- == alison/alisonarts.com.au-ssl_log == -- top paths -- 2 GET /xda.php 2 GET /tinyfilemanager.php 2 GET /test.php 2 GET /radio.php 2 GET /ms-edit.php 2 GET /log.php 2 GET /fm.php 2 GET /doc.php 2 GET /css.php 2 GET /7.php 1 GET /zz.php 1 GET /zoom1.php -- last 10 requests -- 4.205.62.107 - - [28/Aug/2026:21:37:06 +1000] "GET /test.config.php HTTP/1.1" 401 36 "-" "-" 4.205.62.107 - - [28/Aug/2026:21:37:06 +1000] "GET /apikeys.php HTTP/1.1" 401 36 "-" "-" 4.205.62.107 - - [28/Aug/2026:21:37:07 +1000] "GET /god.php HTTP/1.1" 401 36 "-" "-" 4.205.62.107 - - [28/Aug/2026:21:37:08 +1000] "GET /fleen.php HTTP/1.1" 401 36 "-" "-" 4.205.62.107 - - [28/Aug/2026:21:37:08 +1000] "GET /phpinfo01.php HTTP/1.1" 401 36 "-" "-" 4.205.62.107 - - [28/Aug/2026:21:37:09 +1000] "GET /infos.php HTTP/1.1" 401 36 "-" "-" 4.205.62.107 - - [28/Aug/2026:21:37:10 +1000] "GET /vx.php HTTP/1.1" 401 36 "-" "-" 4.205.62.107 - - [28/Aug/2026:21:37:11 +1000] "GET /radio.php HTTP/1.1" 401 36 "-" "-" 4.205.62.107 - - [28/Aug/2026:21:37:12 +1000] "GET /BDKR28WP.php HTTP/1.1" 401 36 "-" "-" 4.205.62.107 - - [28/Aug/2026:21:37:13 +1000] "GET /setup-config.php HTTP/1.1" 401 36 "-" "-" == tubesupplies/tubesupplies.com.au-ssl_log == -- top paths -- 4 POST /wp-login.php 1 POST /wp-cron.php 1 GET /src/ses.yml 1 GET /src/ses.php 1 GET /src/ses.env 1 GET /src/s3.yml 1 GET /src/keys.yml 1 GET /src/.env.aws 1 GET /src/credentials.yml 1 GET /src/credentials.env 1 GET /src/credentials 1 GET /src/config -- last 10 requests -- 185.177.72.11 - - [28/Aug/2026:21:37:08 +1000] "GET /services/postmark/.env.bak HTTP/1.1" 403 12 "-" "curl/8.7.1" 185.177.72.11 - - [28/Aug/2026:21:37:08 +1000] "GET /services/postmark/config.php HTTP/1.1" 401 53 "-" "curl/8.7.1" 185.177.72.11 - - [28/Aug/2026:21:37:09 +1000] "GET /services/postmark/config.yml HTTP/1.1" 401 53 "-" "curl/8.7.1" 185.177.72.11 - - [28/Aug/2026:21:37:09 +1000] "GET /services/postmark/credentials.yml HTTP/1.1" 401 53 "-" "curl/8.7.1" 185.177.72.11 - - [28/Aug/2026:21:37:12 +1000] "GET /services/postmark/settings.php HTTP/1.1" 401 53 "-" "curl/8.7.1" 185.177.72.11 - - [28/Aug/2026:21:37:13 +1000] "GET /services/brevo/.env HTTP/1.1" 403 12 "-" "curl/8.7.1" 185.177.72.11 - - [28/Aug/2026:21:37:13 +1000] "GET /services/brevo/.env.local HTTP/1.1" 403 12 "-" "curl/8.7.1" 185.177.72.11 - - [28/Aug/2026:21:37:13 +1000] "GET /services/brevo/.env.production HTTP/1.1" 403 12 "-" "curl/8.7.1" 185.177.72.11 - - [28/Aug/2026:21:37:14 +1000] "GET /services/brevo/.env.bak HTTP/1.1" 403 12 "-" "curl/8.7.1" 185.177.72.11 - - [28/Aug/2026:21:37:14 +1000] "GET /services/brevo/config.php HTTP/1.1" 401 53 "-" "curl/8.7.1" == speedlin/speedlinefencing.com.au-ssl_log == -- top paths -- 2 GET /ms-edit.php 1 GET /zz.php 1 GET /zaza.php 1 GET /xza.php 1 GET /xve22.php 1 GET /xp.php 1 GET /xin1.php 1 GET /xda.php 1 GET /xa.php 1 GET /X57.php 1 GET /wsws.php 1 GET /ws79.php -- last 10 requests -- 4.205.62.107 - - [28/Aug/2026:21:36:58 +1000] "GET /test.config.php HTTP/1.1" 401 36 "-" "-" 4.205.62.107 - - [28/Aug/2026:21:36:58 +1000] "GET /apikeys.php HTTP/1.1" 401 36 "-" "-" 4.205.62.107 - - [28/Aug/2026:21:36:59 +1000] "GET /god.php HTTP/1.1" 401 36 "-" "-" 4.205.62.107 - - [28/Aug/2026:21:36:59 +1000] "GET /fleen.php HTTP/1.1" 401 36 "-" "-" 4.205.62.107 - - [28/Aug/2026:21:37:00 +1000] "GET /phpinfo01.php HTTP/1.1" 401 36 "-" "-" 4.205.62.107 - - [28/Aug/2026:21:37:00 +1000] "GET /infos.php HTTP/1.1" 401 36 "-" "-" 4.205.62.107 - - [28/Aug/2026:21:37:01 +1000] "GET /vx.php HTTP/1.1" 401 36 "-" "-" 4.205.62.107 - - [28/Aug/2026:21:37:01 +1000] "GET /radio.php HTTP/1.1" 401 36 "-" "-" 4.205.62.107 - - [28/Aug/2026:21:37:02 +1000] "GET /BDKR28WP.php HTTP/1.1" 401 36 "-" "-" 4.205.62.107 - - [28/Aug/2026:21:37:03 +1000] "GET /setup-config.php HTTP/1.1" 401 36 "-" "-" --- last 30 samples (run-up to this incident) --- 2026-08-28 21:34:53 L1=0.59 run=1 blk=0 avail=8804 (63.9%) swpO=0 conn=1 myRSS=2574 php=3 phpRSS=180 ap=19 tcp=29 topuser=madalice 2026-08-28 21:34:58 L1=0.70 run=1 blk=0 avail=8811 (64.0%) swpO=0 conn=1 myRSS=2574 php=3 phpRSS=180 ap=18 tcp=31 topuser=madalice 2026-08-28 21:35:03 L1=0.65 run=4 blk=0 avail=8659 (62.8%) swpO=0 conn=1 myRSS=2574 php=5 phpRSS=380 ap=18 tcp=32 topuser=madalice 2026-08-28 21:35:08 L1=0.68 run=2 blk=0 avail=8810 (64.0%) swpO=0 conn=1 myRSS=2574 php=3 phpRSS=180 ap=18 tcp=31 topuser=madalice 2026-08-28 21:35:13 L1=0.70 run=2 blk=0 avail=8876 (64.4%) swpO=0 conn=1 myRSS=2574 php=3 phpRSS=117 ap=18 tcp=34 topuser=alison 2026-08-28 21:35:18 L1=0.65 run=3 blk=0 avail=8760 (63.6%) swpO=0 conn=1 myRSS=2574 php=5 phpRSS=300 ap=19 tcp=36 topuser=madalice 2026-08-28 21:35:23 L1=0.67 run=3 blk=0 avail=8776 (63.7%) swpO=0 conn=1 myRSS=2574 php=4 phpRSS=230 ap=20 tcp=31 topuser=madalice 2026-08-28 21:35:28 L1=0.62 run=5 blk=0 avail=8714 (63.3%) swpO=0 conn=1 myRSS=2574 php=3 phpRSS=193 ap=19 tcp=34 topuser=madalice 2026-08-28 21:35:33 L1=0.89 run=7 blk=0 avail=8584 (62.3%) swpO=0 conn=1 myRSS=2574 php=4 phpRSS=316 ap=20 tcp=36 topuser=madalice 2026-08-28 21:35:38 L1=1.06 run=1 blk=0 avail=8765 (63.6%) swpO=0 conn=1 myRSS=2574 php=3 phpRSS=202 ap=20 tcp=35 topuser=madalice 2026-08-28 21:35:43 L1=0.97 run=2 blk=0 avail=8779 (63.7%) swpO=1 conn=2 myRSS=2574 php=3 phpRSS=207 ap=20 tcp=34 topuser=madalice 2026-08-28 21:35:48 L1=1.06 run=4 blk=0 avail=8565 (62.2%) swpO=1 conn=1 myRSS=2574 php=5 phpRSS=417 ap=21 tcp=36 topuser=madalice 2026-08-28 21:35:53 L1=0.97 run=1 blk=0 avail=8615 (62.5%) swpO=1 conn=2 myRSS=2574 php=4 phpRSS=357 ap=22 tcp=31 topuser=madalice 2026-08-28 21:35:58 L1=1.06 run=3 blk=0 avail=8520 (61.8%) swpO=1 conn=3 myRSS=2574 php=6 phpRSS=517 ap=22 tcp=32 topuser=madalice 2026-08-28 21:36:03 L1=1.05 run=3 blk=0 avail=8589 (62.3%) swpO=0 conn=2 myRSS=2574 php=5 phpRSS=423 ap=22 tcp=33 topuser=madalice 2026-08-28 21:36:08 L1=1.05 run=3 blk=0 avail=8459 (61.4%) swpO=0 conn=3 myRSS=2574 php=5 phpRSS=554 ap=22 tcp=32 topuser=madalice 2026-08-28 21:36:13 L1=1.20 run=4 blk=0 avail=8533 (61.9%) swpO=0 conn=2 myRSS=2574 php=6 phpRSS=501 ap=22 tcp=33 topuser=madalice 2026-08-28 21:36:18 L1=1.43 run=1 blk=0 avail=8608 (62.5%) swpO=0 conn=3 myRSS=2574 php=4 phpRSS=359 ap=22 tcp=36 topuser=madalice 2026-08-28 21:36:24 L1=1.31 run=2 blk=0 avail=8582 (62.3%) swpO=0 conn=2 myRSS=2574 php=5 phpRSS=398 ap=22 tcp=31 topuser=madalice 2026-08-28 21:36:28 L1=1.21 run=1 blk=0 avail=8618 (62.6%) swpO=0 conn=3 myRSS=2574 php=4 phpRSS=359 ap=21 tcp=30 topuser=madalice 2026-08-28 21:36:34 L1=1.19 run=1 blk=0 avail=8613 (62.5%) swpO=0 conn=2 myRSS=2574 php=5 phpRSS=398 ap=20 tcp=35 topuser=madalice 2026-08-28 21:36:38 L1=1.17 run=3 blk=0 avail=8761 (63.6%) swpO=0 conn=3 myRSS=2574 php=4 phpRSS=242 ap=21 tcp=35 topuser=madalice 2026-08-28 21:36:44 L1=1.08 run=3 blk=0 avail=8679 (63.0%) swpO=0 conn=4 myRSS=2574 php=5 phpRSS=321 ap=22 tcp=34 topuser=madalice 2026-08-28 21:36:48 L1=0.99 run=3 blk=0 avail=8583 (62.3%) swpO=0 conn=3 myRSS=2574 php=5 phpRSS=375 ap=23 tcp=34 topuser=madalice 2026-08-28 21:36:54 L1=0.91 run=1 blk=0 avail=8591 (62.4%) swpO=0 conn=4 myRSS=2574 php=5 phpRSS=375 ap=23 tcp=34 topuser=madalice 2026-08-28 21:36:58 L1=1.16 run=2 blk=0 avail=8603 (62.4%) swpO=0 conn=2 myRSS=2574 php=5 phpRSS=375 ap=23 tcp=31 topuser=madalice 2026-08-28 21:37:04 L1=1.07 run=4 blk=0 avail=8464 (61.4%) swpO=0 conn=4 myRSS=2574 php=6 phpRSS=565 ap=22 tcp=32 topuser=madalice 2026-08-28 21:37:08 L1=1.14 run=1 blk=0 avail=8582 (62.3%) swpO=0 conn=2 myRSS=2574 php=5 phpRSS=398 ap=22 tcp=39 topuser=madalice 2026-08-28 21:37:14 L1=1.13 run=5 blk=0 avail=8432 (61.2%) swpO=0 conn=4 myRSS=2574 php=7 phpRSS=589 ap=25 tcp=41 topuser=madalice 2026-08-28 21:37:18 L1=1.76 run=4 blk=0 avail=7467 (54.2%) swpO=0 conn=4 myRSS=2574 php=15 phpRSS=1676 ap=32 tcp=41 topuser=madalice