INCIDENT 2026-08-29 01:35:37 trigger: php_rss=1956MB ================================================================== load: 4.68 3.14 2.41 11/686 1293086 ncpu:10 mem_avail: 6750MB/13777MB (49.0%) swap_used:1237MB swapout:1/s blocked(D):0 running:11 iowait:0.1% steal:0.0% php: 13 procs / 1956MB heaviest user: madalice (10 procs, 1810MB) apache: 42 procs tcp_estab: 59 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2816 madalice 10 1782 root 259 1303 nobody 41 898 mailman 20 238 netdata 7 203 cpanellogin 1 102 dovenull 6 58 wp-toolkit 3 56 kurri 3 37 mailnull 3 33 evolution 7 30 lowrange 2 29 zabbix 1 25 dovecot 3 23 named 1 16 aaa 1 15 infinium 1 14 polkitd 1 8 nscd 1 5 --- php workers by user --- USER PROCS RSS_MB madalice 10 1791 root 2 130 evolution 2 24 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 4666 MB Active(file): 3222 MB Inactive(file): 2092 MB Dirty: 7 MB Writeback: 0 MB SReclaimable: 1396 MB CommitLimit: 10984 MB Committed_AS: 9162 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 489033 root 23:16:57 7444 /usr/bin/imunify-agent-proxy 1258079 root 06:01 59524 /opt/imunify360/venv/bin/python3 -m imav.run --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 506671 1 mysql 2883748 12.8 Ssl 23:16:26 /usr/sbin/mariadbd 1279791 510022 madalice 254980 22.0 R 00:35 php-fpm: pool madalice_com_au 1281417 510022 madalice 237160 18.2 R 00:34 php-fpm: pool madalice_com_au 1292987 510022 madalice 229908 47.6 R 00:08 php-fpm: pool madalice_com_au 1292986 510022 madalice 229268 46.1 R 00:08 php-fpm: pool madalice_com_au 1280935 510022 madalice 193344 19.9 R 00:34 php-fpm: pool madalice_com_au 508924 1 netdata 181064 2.0 Ssl 23:15:55 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 1202218 1202214 root 178480 1.6 S 24:36 /usr/local/cpanel/3rdparty/bin/perl /usr/local/cpanel/scripts/gather_update_log_stats --logfile /var/cpanel/updatelogs/last --upload 529389 527476 root 171676 0.0 S 23:11:19 spamd child 1279793 510022 madalice 163504 21.5 S 00:35 php-fpm: pool madalice_com_au 1279792 510022 madalice 163460 20.1 S 00:35 php-fpm: pool madalice_com_au 1292989 510022 madalice 163392 53.1 S 00:07 php-fpm: pool madalice_com_au 1293045 510022 madalice 144292 61.0 R 00:01 php-fpm: pool madalice_com_au 1293050 510022 madalice 117808 57.0 R 00:01 php-fpm: pool madalice_com_au 1256643 1353308 cpanellogin 105304 0.2 S 07:49 /usr/local/cpanel/base/show_template.stor docroot /usr/local/cpanel/base cpanel_locale default_login_theme cpanel server_locale en 1203804 1202218 root 95844 98.0 R 23:21 /usr/local/cpanel/3rdparty/bin/php /opt/cpanel/ea-wappspector/wappspector.phar --max=1 --json --depth=9 /home/evolution 527476 1 root 80976 0.0 Ss 23:12:58 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 2985227 527476 root 70436 0.0 S 11:56:56 spamd child 509266 1 root 70392 0.0 Ss 23:15:52 /usr/lib/systemd/systemd-journald 1258079 1 root 59524 0.4 Ssl 06:01 /opt/imunify360/venv/bin/python3 -m imav.run 509236 509098 root 54668 0.0 Sl 23:15:52 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1353308 1 root 42152 0.1 Ss 37-22:54:18 cpsrvd (SSL) - waiting for connections 1293091 1292720 evolution 40684 0.0 R 00:00 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 939687 1 root 38096 0.0 Ss 01:35:36 lfd - sleeping 510022 1 root 37376 0.0 Ss 23:15:48 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 938582 1 wp-toolkit 33592 0.0 Ss 21:23:29 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 1293077 1469 root 29608 0.0 S 00:00 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 1293055 1469 root 29600 0.0 S 00:01 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 509640 508992 root 28840 0.0 Sl 23:15:50 /usr/libexec/netdata/plugins.d/ebpf.plugin 1 1277153 506832 nobody 26560 0.1 S 01:58 /usr/sbin/httpd -k start 483898 1 zabbix 26196 0.2 Ssl 23:17:09 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 1277112 506832 nobody 25492 0.1 S 02:00 /usr/sbin/httpd -k start 1278346 506832 nobody 25212 0.0 S 00:59 /usr/sbin/httpd -k start 1275343 506832 nobody 24444 0.0 S 03:45 /usr/sbin/httpd -k start 1277122 506832 nobody 24444 0.0 S 01:59 /usr/sbin/httpd -k start 1286442 506832 nobody 24440 0.1 S 00:30 /usr/sbin/httpd -k start 1286445 506832 nobody 24280 0.1 S 00:30 /usr/sbin/httpd -k start 1277152 506832 nobody 24268 0.1 S 01:58 /usr/sbin/httpd -k start 1292721 506832 nobody 24236 0.1 S 00:26 /usr/sbin/httpd -k start 1469 1 root 24168 0.1 Ss 60-15:25:47 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 1278456 506832 nobody 24156 0.0 S 00:56 /usr/sbin/httpd -k start 1278359 506832 nobody 24152 0.1 S 00:58 /usr/sbin/httpd -k start 1278358 506832 nobody 24128 0.0 S 00:58 /usr/sbin/httpd -k start 1292749 506832 nobody 24056 0.0 S 00:23 /usr/sbin/httpd -k start 1293023 506832 nobody 24032 0.3 S 00:03 /usr/sbin/httpd -k start 1278449 506832 nobody 23892 0.2 S 00:56 /usr/sbin/httpd -k start 1278357 506832 nobody 23792 0.0 S 00:58 /usr/sbin/httpd -k start 1277182 506832 nobody 23676 0.1 S 01:57 /usr/sbin/httpd -k start 1293035 506832 nobody 23584 0.5 S 00:02 /usr/sbin/httpd -k start 1293036 506832 nobody 23496 0.5 S 00:02 /usr/sbin/httpd -k start 1277154 506832 nobody 23488 0.1 S 01:58 /usr/sbin/httpd -k start 1278461 506832 nobody 23368 0.0 S 00:56 /usr/sbin/httpd -k start 1277155 506832 nobody 23112 0.1 S 01:58 /usr/sbin/httpd -k start 1278409 506832 nobody 23100 0.0 S 00:57 /usr/sbin/httpd -k start 1278410 506832 nobody 22940 0.0 S 00:57 /usr/sbin/httpd -k start 1292751 506832 nobody 22864 0.0 S 00:22 /usr/sbin/httpd -k start 1292748 506832 nobody 22732 0.0 S 00:23 /usr/sbin/httpd -k start 1278464 506832 nobody 22640 0.0 S 00:56 /usr/sbin/httpd -k start 1275308 506832 nobody 22168 0.0 S 03:46 /usr/sbin/httpd -k start 1293000 506832 nobody 22112 0.0 S 00:05 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+-------------+-------------+---------+------+----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+-------------+-------------+---------+------+----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 3764337 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | | 3764329 | madalice_wp | madalice_wp | Query | 0 | starting | UPDATE `AMuqf6qZ_options` SET `option_value` = 'a:530:{s:24:\"^wc-auth/v([1]{1})/(.*)?\";s:63:\"index.php?wc-auth-version=$matches[1]&wc-auth-route=$matches[2]\";s:21:\"^wc/file/transient/?$\";s:33:\"index.php?wc-transient-file-name=\";s:24:\"^wc/file/transient/(.+)$\";s:44:\"index.php?wc-transient- | +---------+-------------+-------------+---------+------+----------------------+--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min speedlin/speedlinefencing.com.au-ssl_log 295 alison/alisonarts.com.au-ssl_log 129 evolution/my.evolutionerp.com.au-ssl_log 126 evolution/release.evolutionerp.com.au 91 customc/customcentral.com.au-ssl_log 83 whiz/whizengineering.com.au-ssl_log 78 aaa/aaadownunder.com.au-ssl_log 46 candyfabcom/candyfab.com.au-ssl_log 41 otterfencing/otterfencing.com.au-ssl_log 39 madalice/madalice.com.au-ssl_log 26 tubesupplies/tubesupplies.com.au-ssl_log 26 evolution/portal.evolutionerp.com.au-ssl_log 25 evolution/evolutionerp.com.au-ssl_log 22 (total vhosts taking traffic: 13) --- top client IPs across all vhosts (last 3 min) --- 295 68.155.159.216 207 20.104.18.15 126 20.104.50.220 68 20.63.81.20 62 74.248.24.12 48 4.204.200.136 41 4.205.62.107 32 34.134.225.59 24 203.54.180.238 20 195.178.110.28 18 13.213.5.99 16 35.231.133.27 16 118.127.40.55 8 91.92.42.71 4 94.154.43.74 --- top request paths across all vhosts (last 3 min) --- 167 GET /autodiscover/autodiscover.xml 26 GET / 24 GET /heartbeat.php 12 POST /wp-login.php 10 GET /index.php 9 POST /wp-cron.php 7 POST / 7 GET /goods.php 6 GET /wp-content/plugins/hellopress/wp_filemanager.php 6 GET /this_is_a_new_hello_world.php 5 GET /admin.php 4 GET /wp-content/uploads/ 4 GET /shiny.php 4 GET /radio.php 4 GET /images.php 4 GET /about.php 4 GET /1.php 3 GET /xx.php 3 GET /ws55.php 3 GET /wp-trackback.php --- busiest 3 vhosts: top paths + last 10 requests --- == speedlin/speedlinefencing.com.au-ssl_log == -- top paths -- 1 GET /xxx.php 1 GET /xx.php 1 GET /xpw.php 1 GET /x.php 1 GET /xmlrpc.php 1 GET /ws.php 1 GET /wp-trackback.php 1 GET /wp-signup.php 1 GET /wp-seo.php 1 GET /wp.php 1 GET /wp-mail.php 1 GET /wp-login.php -- last 10 requests -- 68.155.159.216 - - [29/Aug/2026:01:35:22 +1000] "GET /wp-includes/images/about.php HTTP/1.1" 404 5750 "-" "-" 68.155.159.216 - - [29/Aug/2026:01:35:22 +1000] "GET /ova.php HTTP/1.1" 404 5750 "-" "-" 68.155.159.216 - - [29/Aug/2026:01:35:23 +1000] "GET /wp-admin/css/colors/coffee/about.php HTTP/1.1" 404 5750 "-" "-" 68.155.159.216 - - [29/Aug/2026:01:35:23 +1000] "GET /wp-content/themes/alera/alpha.php HTTP/1.1" 404 5750 "-" "-" 68.155.159.216 - - [29/Aug/2026:01:35:23 +1000] "GET /wp-admin/users.php HTTP/1.1" 404 5750 "-" "-" 68.155.159.216 - - [29/Aug/2026:01:35:24 +1000] "GET /defaults.php HTTP/1.1" 404 5750 "-" "-" 68.155.159.216 - - [29/Aug/2026:01:35:24 +1000] "GET /wp-includes/blocks/about.php HTTP/1.1" 404 5750 "-" "-" 68.155.159.216 - - [29/Aug/2026:01:35:24 +1000] "GET /wp-includes/Text/about.php HTTP/1.1" 404 5750 "-" "-" 68.155.159.216 - - [29/Aug/2026:01:35:25 +1000] "GET /wp-content/themes/wp-pridmag/init.php HTTP/1.1" 404 5750 "-" "-" 68.155.159.216 - - [29/Aug/2026:01:35:25 +1000] "GET /wp-content/themes/index.php HTTP/1.1" 404 5750 "-" "-" == alison/alisonarts.com.au-ssl_log == -- top paths -- 126 GET /autodiscover/autodiscover.xml 2 GET / 1 POST /wp-login.php -- last 10 requests -- 20.104.50.220 - - [29/Aug/2026:01:35:20 +1000] "GET /autodiscover/autodiscover.xml HTTP/1.1" 400 52 "-" "-" 20.104.50.220 - - [29/Aug/2026:01:35:21 +1000] "GET /autodiscover/autodiscover.xml HTTP/1.1" 400 52 "-" "-" 20.104.50.220 - - [29/Aug/2026:01:35:22 +1000] "GET /autodiscover/autodiscover.xml HTTP/1.1" 400 52 "-" "-" 20.104.50.220 - - [29/Aug/2026:01:35:23 +1000] "GET /autodiscover/autodiscover.xml HTTP/1.1" 400 52 "-" "-" 20.104.50.220 - - [29/Aug/2026:01:35:24 +1000] "GET /autodiscover/autodiscover.xml HTTP/1.1" 400 52 "-" "-" 20.104.50.220 - - [29/Aug/2026:01:35:25 +1000] "GET /autodiscover/autodiscover.xml HTTP/1.1" 400 52 "-" "-" 20.104.50.220 - - [29/Aug/2026:01:35:26 +1000] "GET /autodiscover/autodiscover.xml HTTP/1.1" 400 52 "-" "-" 20.104.50.220 - - [29/Aug/2026:01:35:26 +1000] "GET /autodiscover/autodiscover.xml HTTP/1.1" 400 52 "-" "-" 20.104.50.220 - - [29/Aug/2026:01:35:27 +1000] "GET /autodiscover/autodiscover.xml HTTP/1.1" 400 52 "-" "-" 20.104.50.220 - - [29/Aug/2026:01:35:28 +1000] "GET /autodiscover/autodiscover.xml HTTP/1.1" 400 52 "-" "-" == evolution/my.evolutionerp.com.au-ssl_log == -- top paths -- 10 GET /index.php 2 GET /goods.php 1 GET /zoo2.php 1 GET /zoo1.php 1 GET /xty.php 1 GET /wsd.php 1 GET /ws85.php 1 GET /ws55.php 1 GET /wp-trackback.php 1 GET /wp-safe.php 1 GET /wp.php 1 GET /wp-includes/index.php -- last 10 requests -- 20.104.18.15 - - [29/Aug/2026:01:35:30 +1000] "GET /wp-trackback.php HTTP/1.1" 404 - "-" "-" 20.104.18.15 - - [29/Aug/2026:01:35:31 +1000] "GET /pri.php HTTP/1.1" 404 - "-" "-" 20.104.18.15 - - [29/Aug/2026:01:35:31 +1000] "GET /wp_blog_footer.php HTTP/1.1" 404 - "-" "-" 20.104.18.15 - - [29/Aug/2026:01:35:31 +1000] "GET /sushi.php HTTP/1.1" 404 - "-" "-" 20.104.18.15 - - [29/Aug/2026:01:35:32 +1000] "GET /manga.php HTTP/1.1" 404 - "-" "-" 20.104.18.15 - - [29/Aug/2026:01:35:32 +1000] "GET /asdfghj.php?p= HTTP/1.1" 404 - "-" "-" 20.104.18.15 - - [29/Aug/2026:01:35:33 +1000] "GET /dragonshell.php HTTP/1.1" 404 - "-" "-" 20.104.18.15 - - [29/Aug/2026:01:35:33 +1000] "GET /wp-safe.php HTTP/1.1" 404 - "-" "-" 207.46.13.127 - - [29/Aug/2026:01:35:33 +1000] "GET /index.php?page=quotedit"eid=1667 HTTP/1.1" 200 5256 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; bingbot/2.0; +http://www.bing.com/bingbot.h 20.104.18.15 - - [29/Aug/2026:01:35:34 +1000] "GET /gjewuagf.php HTTP/1.1" 404 - "-" "-" --- last 30 samples (run-up to this incident) --- 2026-08-29 01:33:09 L1=3.06 run=2 blk=0 avail=8363 (60.7%) swpO=0 conn=2 myRSS=2815 php=4 phpRSS=283 ap=20 tcp=34 topuser=madalice 2026-08-29 01:33:16 L1=3.06 run=3 blk=0 avail=8337 (60.5%) swpO=0 conn=2 myRSS=2815 php=5 phpRSS=344 ap=19 tcp=36 topuser=madalice 2026-08-29 01:33:19 L1=3.05 run=3 blk=0 avail=8205 (59.6%) swpO=0 conn=2 myRSS=2815 php=5 phpRSS=318 ap=20 tcp=35 topuser=madalice 2026-08-29 01:33:26 L1=2.97 run=4 blk=0 avail=8434 (61.2%) swpO=0 conn=2 myRSS=2815 php=4 phpRSS=211 ap=20 tcp=35 topuser=root 2026-08-29 01:33:29 L1=2.89 run=2 blk=0 avail=8470 (61.5%) swpO=0 conn=2 myRSS=2815 php=3 phpRSS=146 ap=20 tcp=34 topuser=root 2026-08-29 01:33:36 L1=2.98 run=2 blk=0 avail=8322 (60.4%) swpO=0 conn=2 myRSS=2815 php=4 phpRSS=305 ap=21 tcp=57 topuser=madalice 2026-08-29 01:33:39 L1=2.98 run=2 blk=0 avail=8290 (60.2%) swpO=0 conn=2 myRSS=2815 php=4 phpRSS=305 ap=27 tcp=58 topuser=madalice 2026-08-29 01:33:46 L1=3.14 run=6 blk=0 avail=8105 (58.8%) swpO=0 conn=2 myRSS=2815 php=5 phpRSS=394 ap=46 tcp=49 topuser=madalice 2026-08-29 01:33:49 L1=3.29 run=4 blk=0 avail=8020 (58.2%) swpO=0 conn=2 myRSS=2815 php=5 phpRSS=490 ap=44 tcp=46 topuser=customc 2026-08-29 01:33:56 L1=3.59 run=2 blk=0 avail=8363 (60.7%) swpO=0 conn=2 myRSS=2815 php=3 phpRSS=146 ap=36 tcp=39 topuser=root 2026-08-29 01:33:59 L1=3.62 run=3 blk=0 avail=8374 (60.8%) swpO=0 conn=1 myRSS=2815 php=4 phpRSS=183 ap=33 tcp=35 topuser=root 2026-08-29 01:34:07 L1=3.81 run=3 blk=0 avail=8227 (59.7%) swpO=1 conn=2 myRSS=2815 php=4 phpRSS=282 ap=27 tcp=43 topuser=madalice 2026-08-29 01:34:09 L1=3.75 run=4 blk=0 avail=8236 (59.8%) swpO=1 conn=1 myRSS=2815 php=5 phpRSS=388 ap=25 tcp=41 topuser=madalice 2026-08-29 01:34:17 L1=3.69 run=3 blk=0 avail=8228 (59.7%) swpO=0 conn=2 myRSS=2815 php=5 phpRSS=404 ap=25 tcp=40 topuser=madalice 2026-08-29 01:34:19 L1=3.63 run=4 blk=0 avail=8262 (60.0%) swpO=0 conn=1 myRSS=2815 php=5 phpRSS=373 ap=25 tcp=38 topuser=madalice 2026-08-29 01:34:27 L1=3.42 run=5 blk=0 avail=8325 (60.4%) swpO=0 conn=2 myRSS=2815 php=4 phpRSS=297 ap=24 tcp=33 topuser=customc 2026-08-29 01:34:29 L1=3.47 run=2 blk=0 avail=8441 (61.3%) swpO=0 conn=1 myRSS=2815 php=3 phpRSS=146 ap=24 tcp=36 topuser=root 2026-08-29 01:34:37 L1=3.59 run=2 blk=0 avail=8281 (60.1%) swpO=0 conn=2 myRSS=2815 php=4 phpRSS=337 ap=24 tcp=61 topuser=evolution 2026-08-29 01:34:39 L1=3.54 run=3 blk=0 avail=8300 (60.2%) swpO=0 conn=1 myRSS=2815 php=4 phpRSS=276 ap=31 tcp=64 topuser=evolution 2026-08-29 01:34:47 L1=3.74 run=3 blk=0 avail=8137 (59.1%) swpO=0 conn=2 myRSS=2815 php=4 phpRSS=283 ap=51 tcp=54 topuser=madalice 2026-08-29 01:34:49 L1=3.60 run=4 blk=0 avail=8084 (58.7%) swpO=0 conn=1 myRSS=2815 php=5 phpRSS=410 ap=48 tcp=52 topuser=evolution 2026-08-29 01:34:57 L1=3.47 run=3 blk=0 avail=8225 (59.7%) swpO=0 conn=2 myRSS=2815 php=4 phpRSS=283 ap=41 tcp=49 topuser=madalice 2026-08-29 01:34:59 L1=3.51 run=4 blk=0 avail=7826 (56.8%) swpO=0 conn=2 myRSS=2816 php=6 phpRSS=583 ap=38 tcp=38 topuser=corpkicks 2026-08-29 01:35:07 L1=4.59 run=8 blk=0 avail=7416 (53.8%) swpO=0 conn=2 myRSS=2816 php=10 phpRSS=1287 ap=34 tcp=51 topuser=madalice 2026-08-29 01:35:09 L1=4.63 run=4 blk=0 avail=7365 (53.5%) swpO=0 conn=2 myRSS=2816 php=11 phpRSS=1339 ap=36 tcp=48 topuser=madalice 2026-08-29 01:35:17 L1=4.50 run=6 blk=0 avail=7357 (53.4%) swpO=0 conn=2 myRSS=2816 php=10 phpRSS=1255 ap=46 tcp=59 topuser=madalice 2026-08-29 01:35:20 L1=4.62 run=2 blk=0 avail=7487 (54.3%) swpO=0 conn=2 myRSS=2816 php=9 phpRSS=1103 ap=45 tcp=45 topuser=madalice 2026-08-29 01:35:27 L1=4.41 run=2 blk=0 avail=7538 (54.7%) swpO=0 conn=2 myRSS=2816 php=9 phpRSS=1103 ap=38 tcp=38 topuser=madalice 2026-08-29 01:35:30 L1=4.13 run=8 blk=0 avail=7696 (55.9%) swpO=0 conn=2 myRSS=2816 php=8 phpRSS=942 ap=35 tcp=41 topuser=madalice 2026-08-29 01:35:37 L1=4.68 run=11 blk=0 avail=6750 (49.0%) swpO=1 conn=8 myRSS=2816 php=13 phpRSS=1956 ap=42 tcp=59 topuser=madalice