INCIDENT 2026-08-29 04:53:13 trigger: php_rss=1701MB ================================================================== load: 1.22 1.34 1.46 3/678 1981519 ncpu:10 mem_avail: 7053MB/13777MB (51.2%) swap_used:1258MB swapout:0/s blocked(D):0 running:3 iowait:0.0% steal:0.0% php: 14 procs / 1701MB heaviest user: madalice (10 procs, 1438MB) apache: 34 procs tcp_estab: 50 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2820 madalice 10 1438 root 253 1176 nobody 33 590 customc 2 231 mailman 20 228 netdata 7 206 cpanellogin 1 106 mailnull 5 59 dovenull 6 59 wp-toolkit 3 52 lowrange 3 43 infinium 3 43 kurri 3 37 evolution 7 29 dovecot 3 23 zabbix 1 22 named 1 16 aaa 1 15 polkitd 1 8 --- php workers by user --- USER PROCS RSS_MB madalice 10 1438 customc 2 236 root 1 30 evolution 1 14 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 4430 MB Active(file): 4500 MB Inactive(file): 990 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 1163 MB CommitLimit: 10984 MB Committed_AS: 8580 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 489033 root 1-02:34:33 7504 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 506671 1 mysql 2888292 11.7 Ssl 1-02:34:02 /usr/sbin/mariadbd 1502903 1451906 root 184272 0.0 S 02:16:51 spamd child 508924 1 netdata 181952 2.0 Ssl 1-02:33:31 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 1451906 1 root 175572 0.0 Ss 02:30:06 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 1502904 1451906 root 164920 0.0 S 02:16:51 spamd child 1981033 510022 madalice 163536 13.1 S 00:27 php-fpm: pool madalice_com_au 1981412 510022 madalice 162612 44.0 S 00:06 php-fpm: pool madalice_com_au 1981413 510022 madalice 162588 42.1 S 00:06 php-fpm: pool madalice_com_au 1981414 510022 madalice 161592 60.0 S 00:06 php-fpm: pool madalice_com_au 1981470 510022 madalice 137372 66.5 S 00:02 php-fpm: pool madalice_com_au 1981471 510022 madalice 137372 70.0 S 00:02 php-fpm: pool madalice_com_au 1981472 510022 madalice 137360 72.0 S 00:02 php-fpm: pool madalice_com_au 1981450 510022 madalice 137148 44.3 S 00:03 php-fpm: pool madalice_com_au 1981454 510022 madalice 136984 47.6 S 00:03 php-fpm: pool madalice_com_au 1981451 510022 madalice 136688 44.0 S 00:03 php-fpm: pool madalice_com_au 1981486 1981466 customc 132816 47.0 S 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 1981487 1981467 customc 128636 46.0 R 00:01 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 1416362 1353308 cpanellogin 108796 0.0 S 02:39:05 /usr/local/cpanel/base/show_template.stor server_locale en default_login_theme cpanel cpanel_locale docroot /usr/local/cpanel/base 509266 1 root 81380 0.0 Ss 1-02:33:28 /usr/lib/systemd/systemd-journald 509236 509098 root 49012 0.0 Sl 1-02:33:28 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 1353308 1 root 41168 0.1 Ss 38-02:11:54 cpsrvd (SSL) - waiting for connections 1451116 1 root 36732 0.0 Ss 02:30:59 lfd - sleeping 938582 1 wp-toolkit 31364 0.0 Ss 1-00:41:05 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 510022 1 root 31360 0.0 Ss 1-02:33:24 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 509640 508992 root 30940 0.0 Sl 1-02:33:26 /usr/libexec/netdata/plugins.d/ebpf.plugin 1 1981489 1469 root 29144 0.0 S 00:01 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 1981490 1469 root 29140 0.0 S 00:01 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 1963104 506832 nobody 24728 0.0 S 06:46 /usr/sbin/httpd -k start 1469 1 root 24168 0.1 Ss 60-18:43:23 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 1980287 1964885 root 23476 0.0 S 01:21 /usr/sbin/exim -q 1942855 506832 nobody 23084 0.1 S 12:18 /usr/sbin/httpd -k start 483898 1 zabbix 23080 0.2 Ssl 1-02:34:45 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 1964818 506832 nobody 23076 0.0 S 03:44 /usr/sbin/httpd -k start 1978982 506832 nobody 22952 0.0 S 02:51 /usr/sbin/httpd -k start 1963934 506832 nobody 22860 0.0 S 05:20 /usr/sbin/httpd -k start 1964809 506832 nobody 22384 0.0 S 03:46 /usr/sbin/httpd -k start 1964810 506832 nobody 22120 0.0 S 03:45 /usr/sbin/httpd -k start 1463 1 root 21696 0.0 Ss 60-18:43:23 tailwatchd 1964805 506832 nobody 21248 0.0 S 03:47 /usr/sbin/httpd -k start 1978983 506832 nobody 21140 0.1 S 02:51 /usr/sbin/httpd -k start 1979963 506832 nobody 20776 0.0 S 01:48 /usr/sbin/httpd -k start 938585 1 wp-toolkit 20456 0.0 Ss 1-00:41:05 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php 1980307 1980287 mailnull 20396 0.0 S 01:21 /usr/sbin/exim -q 1980666 506832 nobody 20360 0.0 S 00:45 /usr/sbin/httpd -k start 1981337 506832 nobody 20360 0.3 S 00:10 /usr/sbin/httpd -k start 1980741 506832 nobody 20328 0.0 S 00:39 /usr/sbin/httpd -k start 1981444 506832 nobody 19324 0.6 S 00:03 /usr/sbin/httpd -k start 1981447 506832 nobody 19304 0.3 S 00:03 /usr/sbin/httpd -k start 1981464 506832 nobody 19272 0.5 S 00:02 /usr/sbin/httpd -k start 1981445 506832 nobody 19240 0.3 S 00:03 /usr/sbin/httpd -k start 1981462 506832 nobody 19212 1.0 S 00:02 /usr/sbin/httpd -k start 1981463 506832 nobody 19212 1.0 S 00:02 /usr/sbin/httpd -k start 1981465 506832 nobody 19208 0.5 S 00:02 /usr/sbin/httpd -k start 509671 508992 netdata 17924 2.1 Sl 1-02:33:26 /usr/libexec/netdata/plugins.d/apps.plugin 1 481558 1 root 17420 0.1 Ssl 1-02:35:55 /usr/libexec/platform-python -Es /usr/sbin/tuned -l -P 1981294 506832 nobody 17344 0.0 S 00:11 /usr/sbin/httpd -k start 1980673 506832 nobody 17180 0.1 S 00:44 /usr/sbin/httpd -k start 1981467 506832 nobody 17100 0.0 S 00:02 /usr/sbin/httpd -k start 1981466 506832 nobody 17040 0.0 S 00:02 /usr/sbin/httpd -k start 1981419 506832 nobody 16976 0.0 S 00:05 /usr/sbin/httpd -k start --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 3828341 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min whiz/whizengineering.com.au-ssl_log 173 tubesupplies/tubesupplies.com.au-ssl_log 86 olympic/olympicfencing.com.au-ssl_log 77 vinesit/westpanel.vinesit.com.au-ssl_log 60 madalice/madalice.com.au-ssl_log 23 evolution/portal.evolutionerp.com.au-ssl_log 16 alison/alisonarts.com.au-ssl_log 8 (total vhosts taking traffic: 7) --- top client IPs across all vhosts (last 3 min) --- 102 4.204.200.136 83 20.220.10.235 71 20.48.147.90 70 20.48.250.41 60 158.23.184.117 19 35.227.48.155 16 203.54.180.238 6 192.185.179.137 4 209.141.34.121 3 118.127.40.55 2 91.92.243.243 2 67.43.235.82 2 66.249.73.165 2 104.197.249.29 1 66.249.73.171 --- top request paths across all vhosts (last 3 min) --- 16 GET /heartbeat.php 6 POST /wp-login.php 5 GET /wp-login.php 3 POST / 3 GET /wp-content/plugins/hellopress/wp_filemanager.php 3 GET /this_is_a_new_hello_world.php 3 GET / 2 POST /wp-cron.php 2 HEAD / 2 GET /xwx1.php 2 GET /wp-the.php 2 GET /wp-conffg.php 2 GET /wp-admin/css/bolt.php 2 GET /wp5.php 2 GET /t00l.php 2 GET /setup-config.php 2 GET /sc.php 2 GET /robots.php 2 GET /rk2.php 2 GET /radio.php --- busiest 3 vhosts: top paths + last 10 requests --- == whiz/whizengineering.com.au-ssl_log == -- top paths -- 2 GET /wp-conffg.php 1 GET /xr.php 1 GET /xmini4.php 1 GET /xl2023.php 1 GET /xcc.php 1 GET /wp_xiPu52Ut.php 1 GET /wp-ws68.php 1 GET /wp-validate.php 1 GET /wp-tymanage.php 1 GET /wp-theme.php 1 GET /wp-signup.php 1 GET /wp-settings.php -- last 10 requests -- 4.204.200.136 - - [29/Aug/2026:04:52:52 +1000] "GET /l.php HTTP/1.1" 401 36 "-" "-" 4.204.200.136 - - [29/Aug/2026:04:52:53 +1000] "GET /xr.php HTTP/1.1" 401 36 "-" "-" 4.204.200.136 - - [29/Aug/2026:04:52:53 +1000] "GET /Q3.php HTTP/1.1" 401 36 "-" "-" 4.204.200.136 - - [29/Aug/2026:04:52:53 +1000] "GET /Q1.php HTTP/1.1" 401 36 "-" "-" 4.204.200.136 - - [29/Aug/2026:04:52:54 +1000] "GET /nz.php HTTP/1.1" 401 36 "-" "-" 4.204.200.136 - - [29/Aug/2026:04:52:54 +1000] "GET /sg.php HTTP/1.1" 401 36 "-" "-" 4.204.200.136 - - [29/Aug/2026:04:52:55 +1000] "GET /hypo.php HTTP/1.1" 401 36 "-" "-" 4.204.200.136 - - [29/Aug/2026:04:52:55 +1000] "GET /Hd.php HTTP/1.1" 401 36 "-" "-" 4.204.200.136 - - [29/Aug/2026:04:52:56 +1000] "GET /im.php HTTP/1.1" 401 36 "-" "-" 4.204.200.136 - - [29/Aug/2026:04:52:57 +1000] "GET /fc.php HTTP/1.1" 401 36 "-" "-" == tubesupplies/tubesupplies.com.au-ssl_log == -- top paths -- 2 POST /wp-login.php 2 GET /wp5.php 1 POST /wp-cron.php 1 GET /zwq13.php 1 GET /zs.php 1 GET /zq.php 1 GET /zogy1.php 1 GET /zi.php 1 GET /yw.php 1 GET /ys.php 1 GET /yj.php 1 GET /xxw.php -- last 10 requests -- 20.220.10.235 - - [29/Aug/2026:04:53:04 +1000] "GET /yw.php HTTP/1.1" 401 36 "-" "-" 20.220.10.235 - - [29/Aug/2026:04:53:04 +1000] "GET /lz.php HTTP/1.1" 401 36 "-" "-" 20.220.10.235 - - [29/Aug/2026:04:53:04 +1000] "GET /qf.php HTTP/1.1" 401 36 "-" "-" 20.220.10.235 - - [29/Aug/2026:04:53:05 +1000] "GET /is.php HTTP/1.1" 401 36 "-" "-" 20.220.10.235 - - [29/Aug/2026:04:53:05 +1000] "GET /zq.php HTTP/1.1" 401 36 "-" "-" 20.220.10.235 - - [29/Aug/2026:04:53:06 +1000] "GET /ys.php HTTP/1.1" 401 36 "-" "-" 20.220.10.235 - - [29/Aug/2026:04:53:06 +1000] "GET /sr.php HTTP/1.1" 401 36 "-" "-" 20.220.10.235 - - [29/Aug/2026:04:53:07 +1000] "GET /vf.php HTTP/1.1" 401 36 "-" "-" 20.220.10.235 - - [29/Aug/2026:04:53:07 +1000] "GET /ph.php HTTP/1.1" 401 36 "-" "-" 20.220.10.235 - - [29/Aug/2026:04:53:08 +1000] "GET /zs.php HTTP/1.1" 401 36 "-" "-" == olympic/olympicfencing.com.au-ssl_log == -- top paths -- 3 POST /wp-login.php 3 GET /wp-login.php 1 POST /wp-cron.php 1 GET /xwx1.php 1 GET /xa.php 1 GET /wtiiy.php 1 GET /ws87.php 1 GET /ws85.php 1 GET /ws80.php 1 GET /ws78.php 1 GET /ws58.php 1 GET /ws45.php -- last 10 requests -- 20.48.250.41 - - [29/Aug/2026:04:51:48 +1000] "GET /tool.php HTTP/1.1" 401 36 "-" "-" 20.48.250.41 - - [29/Aug/2026:04:51:49 +1000] "GET /bjfl.php HTTP/1.1" 401 36 "-" "-" 20.48.250.41 - - [29/Aug/2026:04:51:49 +1000] "GET /sid3.php HTTP/1.1" 401 36 "-" "-" 20.48.250.41 - - [29/Aug/2026:04:51:50 +1000] "GET /echkm.php HTTP/1.1" 401 36 "-" "-" 20.48.250.41 - - [29/Aug/2026:04:51:50 +1000] "GET /edit.php HTTP/1.1" 401 36 "-" "-" 20.48.250.41 - - [29/Aug/2026:04:51:51 +1000] "GET /ua.php HTTP/1.1" 401 36 "-" "-" 20.48.250.41 - - [29/Aug/2026:04:51:51 +1000] "GET /wp-p2r3q9c8k4.php HTTP/1.1" 401 36 "-" "-" 20.48.250.41 - - [29/Aug/2026:04:51:52 +1000] "GET /uuu.php HTTP/1.1" 401 36 "-" "-" 20.48.250.41 - - [29/Aug/2026:04:51:52 +1000] "GET /ms-edit.php HTTP/1.1" 401 36 "-" "-" 20.48.250.41 - - [29/Aug/2026:04:51:52 +1000] "GET /222.php HTTP/1.1" 401 36 "-" "-" --- last 30 samples (run-up to this incident) --- 2026-08-29 04:50:47 L1=1.60 run=1 blk=0 avail=8325 (60.4%) swpO=0 conn=4 myRSS=2820 php=3 phpRSS=272 ap=23 tcp=42 topuser=madalice 2026-08-29 04:50:52 L1=1.55 run=2 blk=0 avail=8380 (60.8%) swpO=0 conn=2 myRSS=2820 php=4 phpRSS=271 ap=21 tcp=36 topuser=madalice 2026-08-29 04:50:57 L1=1.59 run=2 blk=0 avail=8369 (60.7%) swpO=0 conn=4 myRSS=2820 php=4 phpRSS=279 ap=20 tcp=40 topuser=madalice 2026-08-29 04:51:02 L1=1.54 run=3 blk=0 avail=8182 (59.4%) swpO=0 conn=2 myRSS=2820 php=5 phpRSS=384 ap=19 tcp=37 topuser=corpkicks 2026-08-29 04:51:07 L1=1.42 run=4 blk=0 avail=8335 (60.5%) swpO=0 conn=4 myRSS=2820 php=4 phpRSS=320 ap=18 tcp=37 topuser=madalice 2026-08-29 04:51:12 L1=1.39 run=1 blk=0 avail=8430 (61.2%) swpO=0 conn=2 myRSS=2820 php=3 phpRSS=201 ap=18 tcp=32 topuser=madalice 2026-08-29 04:51:17 L1=1.35 run=3 blk=0 avail=8184 (59.4%) swpO=0 conn=1 myRSS=2820 php=4 phpRSS=395 ap=17 tcp=35 topuser=corpkicks 2026-08-29 04:51:22 L1=1.25 run=2 blk=0 avail=8320 (60.4%) swpO=0 conn=2 myRSS=2820 php=3 phpRSS=296 ap=17 tcp=35 topuser=madalice 2026-08-29 04:51:27 L1=1.39 run=3 blk=0 avail=8266 (60.0%) swpO=0 conn=1 myRSS=2820 php=5 phpRSS=370 ap=24 tcp=38 topuser=madalice 2026-08-29 04:51:32 L1=1.52 run=1 blk=0 avail=8398 (61.0%) swpO=0 conn=2 myRSS=2820 php=3 phpRSS=203 ap=21 tcp=36 topuser=madalice 2026-08-29 04:51:37 L1=1.47 run=1 blk=0 avail=8405 (61.0%) swpO=0 conn=1 myRSS=2820 php=3 phpRSS=203 ap=19 tcp=34 topuser=madalice 2026-08-29 04:51:42 L1=1.36 run=3 blk=0 avail=8339 (60.5%) swpO=0 conn=2 myRSS=2820 php=5 phpRSS=339 ap=18 tcp=36 topuser=madalice 2026-08-29 04:51:47 L1=1.33 run=1 blk=0 avail=8547 (62.0%) swpO=0 conn=1 myRSS=2820 php=2 phpRSS=45 ap=17 tcp=36 topuser=root 2026-08-29 04:51:52 L1=1.22 run=1 blk=0 avail=8557 (62.1%) swpO=0 conn=2 myRSS=2820 php=2 phpRSS=45 ap=17 tcp=32 topuser=root 2026-08-29 04:51:57 L1=1.12 run=1 blk=0 avail=8560 (62.1%) swpO=0 conn=1 myRSS=2820 php=2 phpRSS=45 ap=16 tcp=34 topuser=root 2026-08-29 04:52:03 L1=1.03 run=2 blk=0 avail=8495 (61.7%) swpO=0 conn=1 myRSS=2820 php=2 phpRSS=45 ap=16 tcp=32 topuser=root 2026-08-29 04:52:07 L1=0.95 run=1 blk=0 avail=8583 (62.3%) swpO=0 conn=1 myRSS=2820 php=2 phpRSS=45 ap=16 tcp=31 topuser=root 2026-08-29 04:52:13 L1=0.87 run=1 blk=0 avail=8580 (62.3%) swpO=0 conn=1 myRSS=2820 php=2 phpRSS=45 ap=15 tcp=33 topuser=root 2026-08-29 04:52:17 L1=0.80 run=1 blk=0 avail=8578 (62.3%) swpO=0 conn=1 myRSS=2820 php=2 phpRSS=45 ap=15 tcp=37 topuser=root 2026-08-29 04:52:23 L1=0.74 run=1 blk=0 avail=8578 (62.3%) swpO=0 conn=1 myRSS=2820 php=2 phpRSS=45 ap=15 tcp=34 topuser=root 2026-08-29 04:52:27 L1=0.84 run=2 blk=0 avail=8417 (61.1%) swpO=0 conn=1 myRSS=2820 php=4 phpRSS=255 ap=15 tcp=37 topuser=madalice 2026-08-29 04:52:33 L1=0.85 run=3 blk=0 avail=8355 (60.6%) swpO=0 conn=1 myRSS=2820 php=5 phpRSS=332 ap=18 tcp=40 topuser=madalice 2026-08-29 04:52:37 L1=0.78 run=3 blk=0 avail=8276 (60.1%) swpO=0 conn=1 myRSS=2820 php=5 phpRSS=387 ap=19 tcp=42 topuser=madalice 2026-08-29 04:52:43 L1=0.80 run=3 blk=0 avail=8434 (61.2%) swpO=0 conn=1 myRSS=2820 php=4 phpRSS=218 ap=19 tcp=35 topuser=madalice 2026-08-29 04:52:47 L1=0.90 run=1 blk=0 avail=8448 (61.3%) swpO=0 conn=1 myRSS=2820 php=3 phpRSS=167 ap=18 tcp=37 topuser=madalice 2026-08-29 04:52:53 L1=0.83 run=1 blk=0 avail=8458 (61.4%) swpO=0 conn=1 myRSS=2820 php=3 phpRSS=167 ap=18 tcp=31 topuser=madalice 2026-08-29 04:52:57 L1=0.76 run=1 blk=0 avail=8466 (61.5%) swpO=0 conn=1 myRSS=2820 php=3 phpRSS=167 ap=17 tcp=36 topuser=madalice 2026-08-29 04:53:03 L1=0.78 run=4 blk=0 avail=8168 (59.3%) swpO=0 conn=4 myRSS=2820 php=6 phpRSS=540 ap=18 tcp=41 topuser=olympic 2026-08-29 04:53:07 L1=0.72 run=1 blk=0 avail=8441 (61.3%) swpO=0 conn=1 myRSS=2820 php=3 phpRSS=167 ap=19 tcp=39 topuser=madalice 2026-08-29 04:53:13 L1=1.22 run=3 blk=0 avail=7053 (51.2%) swpO=0 conn=3 myRSS=2820 php=14 phpRSS=1701 ap=34 tcp=50 topuser=madalice