INCIDENT 2026-08-29 16:24:33 trigger: php_rss=1559MB ================================================================== load: 1.07 0.83 0.92 13/658 169632 ncpu:10 mem_avail: 7319MB/13777MB (53.1%) swap_used:1486MB swapout:3/s blocked(D):0 running:10 iowait:0.0% steal:0.0% php: 11 procs / 1559MB heaviest user: madalice (8 procs, 1448MB) apache: 36 procs tcp_estab: 43 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2734 madalice 8 1520 root 245 1005 nobody 34 612 netdata 7 205 mailman 20 190 alison 1 74 cpanellogin 1 62 dovenull 6 55 wp-toolkit 3 43 kurri 2 28 candyfabcom 2 28 evolution 7 27 zabbix 1 22 dovecot 3 22 named 1 16 lowrange 1 14 mailnull 1 8 polkitd 1 6 nscd 1 5 --- php workers by user --- USER PROCS RSS_MB madalice 8 1532 alison 1 75 root 1 27 evolution 1 13 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 4517 MB Active(file): 4265 MB Inactive(file): 787 MB Dirty: 0 MB Writeback: 0 MB SReclaimable: 550 MB CommitLimit: 10984 MB Committed_AS: 8455 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 489033 root 1-14:05:53 7112 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 506671 1 mysql 2800508 9.3 Ssl 1-14:05:22 /usr/sbin/mariadbd 168742 510022 madalice 248524 14.5 R 01:34 php-fpm: pool madalice_com_au 169565 510022 madalice 240256 22.7 R 00:10 php-fpm: pool madalice_com_au 169564 510022 madalice 231204 21.8 R 00:10 php-fpm: pool madalice_com_au 169567 510022 madalice 226832 21.7 R 00:10 php-fpm: pool madalice_com_au 169563 510022 madalice 216292 21.8 S 00:10 php-fpm: pool madalice_com_au 508924 1 netdata 184880 2.0 Ssl 1-14:04:51 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 169562 510022 madalice 183608 29.4 R 00:10 php-fpm: pool madalice_com_au 169602 510022 madalice 162340 77.0 R 00:01 php-fpm: pool madalice_com_au 1502904 1451906 root 161224 0.0 S 13:48:11 spamd child 169601 510022 madalice 152568 75.0 R 00:01 php-fpm: pool madalice_com_au 83639 1451906 root 147364 0.0 S 26:59 spamd child 1451906 1 root 132116 0.0 Ss 14:01:26 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 509266 1 root 107536 0.0 Ss 1-14:04:48 /usr/lib/systemd/systemd-journald 169603 169204 alison 83600 46.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 509236 509098 root 64304 0.0 Sl 1-14:04:48 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 133529 1353308 cpanellogin 63532 0.1 S 12:51 /usr/local/cpanel/base/show_template.stor docroot /usr/local/cpanel/base cpanel_locale default_login_theme cpanel server_locale en 1353308 1 root 42372 0.1 Ss 38-13:43:14 cpsrvd (SSL) - waiting for connections 509640 508992 root 37616 0.0 Sl 1-14:04:46 /usr/libexec/netdata/plugins.d/ebpf.plugin 1 1451116 1 root 33364 0.0 Ss 14:02:19 lfd - sleeping 510022 1 root 28324 0.0 Ss 1-14:04:44 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 938582 1 wp-toolkit 25652 0.0 Ss 1-12:12:25 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 167665 506832 nobody 23356 0.0 S 02:33 /usr/sbin/httpd -k start 483898 1 zabbix 22564 0.2 Ssl 1-14:06:05 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 1469 1 root 22400 0.1 Ss 61-06:14:43 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 167664 506832 nobody 21568 0.0 S 02:33 /usr/sbin/httpd -k start 167753 506832 nobody 21532 0.0 S 02:30 /usr/sbin/httpd -k start 1463 1 root 21388 0.0 Ss 61-06:14:43 tailwatchd 167722 506832 nobody 21228 0.0 S 02:31 /usr/sbin/httpd -k start 167761 506832 nobody 20988 0.0 S 02:30 /usr/sbin/httpd -k start 167756 506832 nobody 20756 0.0 S 02:30 /usr/sbin/httpd -k start 167766 506832 nobody 20716 0.0 S 02:30 /usr/sbin/httpd -k start 167797 506832 nobody 20652 0.0 S 02:29 /usr/sbin/httpd -k start 167771 506832 nobody 20576 0.0 S 02:30 /usr/sbin/httpd -k start 167745 506832 nobody 20508 0.0 S 02:30 /usr/sbin/httpd -k start 169250 506832 nobody 20268 0.0 S 00:57 /usr/sbin/httpd -k start 167835 506832 nobody 20120 0.0 S 02:29 /usr/sbin/httpd -k start 167716 506832 nobody 20028 0.0 S 02:31 /usr/sbin/httpd -k start 167884 506832 nobody 19716 0.0 S 02:28 /usr/sbin/httpd -k start 167802 506832 nobody 19704 0.0 S 02:29 /usr/sbin/httpd -k start 169236 506832 nobody 19468 0.0 S 00:57 /usr/sbin/httpd -k start 169199 506832 nobody 19208 0.0 S 00:58 /usr/sbin/httpd -k start 167860 506832 nobody 18708 0.0 S 02:28 /usr/sbin/httpd -k start 167810 506832 nobody 18680 0.0 S 02:29 /usr/sbin/httpd -k start 167866 506832 nobody 18600 0.0 S 02:28 /usr/sbin/httpd -k start 169190 506832 nobody 18344 0.0 S 01:00 /usr/sbin/httpd -k start 169242 506832 nobody 18340 0.0 S 00:57 /usr/sbin/httpd -k start 167883 506832 nobody 17796 0.0 S 02:28 /usr/sbin/httpd -k start 169202 506832 nobody 17688 0.0 S 00:58 /usr/sbin/httpd -k start 169237 506832 nobody 17652 0.0 S 00:57 /usr/sbin/httpd -k start 169205 506832 nobody 17648 0.0 S 00:58 /usr/sbin/httpd -k start 169198 506832 nobody 17576 0.0 S 00:59 /usr/sbin/httpd -k start 169195 506832 nobody 17472 0.0 S 00:59 /usr/sbin/httpd -k start 169244 506832 nobody 17460 0.0 S 00:57 /usr/sbin/httpd -k start 169235 506832 nobody 17448 0.0 S 00:57 /usr/sbin/httpd -k start 167821 506832 nobody 17432 0.0 S 02:29 /usr/sbin/httpd -k start 169204 506832 nobody 17412 0.0 S 00:58 /usr/sbin/httpd -k start 508634 1 named 17400 0.0 Ssl 1-14:04:56 /usr/sbin/pdns_server --socket-dir=/run/pdns --guardian=no --daemon=no --disable-syslog --log-timestamp=no --write-pid=no 509671 508992 netdata 17068 2.1 Sl 1-14:04:46 /usr/libexec/netdata/plugins.d/apps.plugin 1 938585 1 wp-toolkit 16232 0.0 Ss 1-12:12:25 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+-------------+-------------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+-------------+-------------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 4097748 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | | 4097740 | madalice_wp | madalice_wp | Query | 0 | Writing to net | select * from AMuqf6qZ_addonlibrary_addons as addons where addons.addontype in('elementor','bg_addon') and addons.is_active=1 | +---------+-------------+-------------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min aaa/aaadownunder.com.au 136 aaa/aaadownunder.com.au-ssl_log 126 candyfabcom/candyfab.com.au-ssl_log 122 alison/alisonarts.com.au-ssl_log 121 kurri/kurrimotorinn.com.au-ssl_log 79 cosgrovecreative/cosgrovecreative.com.au-ssl_log 59 evolution/portal.evolutionerp.com.au-ssl_log 27 madalice/madalice.com.au-ssl_log 27 alison/alisonarts.com.au 23 vinesit/vinesit.com.au-ssl_log 17 infinium/infinium.net.au-ssl_log 11 (total vhosts taking traffic: 11) --- top client IPs across all vhosts (last 3 min) --- 314 20.48.179.39 136 52.139.37.240 122 20.151.129.194 79 20.48.251.3 27 203.54.180.238 18 2a02:26f7:e48c:5704:0:a000:0:6 16 20.48.250.41 7 118.127.40.55 5 162.0.232.248 4 35.221.72.108 2 57.129.136.36 2 43.135.153.177 2 34.14.60.202 2 114.119.143.14 2 114.119.143.104 --- top request paths across all vhosts (last 3 min) --- 27 GET /heartbeat.php 16 GET /autodiscover/autodiscover.xml 9 GET / 8 POST / 6 POST /wp-login.php 6 GET /wp-login.php 6 GET /store/hand-painted-nike-af1-wildroses/ 6 GET /k.php 6 GET /goods.php 6 GET /classwithtostring.php 6 GET /222.php 5 GET /wsd.php 5 GET /sf.php 5 GET /ops.php 5 GET /m.php 5 GET /inso.php 5 GET /img.php 5 GET /images.php 5 GET /fling.php 5 GET /dex.php --- busiest 3 vhosts: top paths + last 10 requests --- == aaa/aaadownunder.com.au == -- top paths -- 2 GET /goods.php 1 GET /zoo2.php 1 GET /zoo1.php 1 GET /xty.php 1 GET /x.php 1 GET /xmini4.php 1 GET /wsd.php 1 GET /ws85.php 1 GET /ws55.php 1 GET /wp-trackback.php 1 GET /wp-safe.php 1 GET /wp.php -- last 10 requests -- 20.48.179.39 - - [29/Aug/2026:16:23:34 +1000] "GET /wp-admin/js/wp-load.php HTTP/1.1" 301 299 "-" "-" 20.48.179.39 - - [29/Aug/2026:16:23:35 +1000] "GET /robot.php HTTP/1.1" 301 285 "-" "-" 20.48.179.39 - - [29/Aug/2026:16:23:35 +1000] "GET /revo.php HTTP/1.1" 301 284 "-" "-" 20.48.179.39 - - [29/Aug/2026:16:23:35 +1000] "GET /birrs.php HTTP/1.1" 301 285 "-" "-" 20.48.179.39 - - [29/Aug/2026:16:23:36 +1000] "GET /sss.php?p= HTTP/1.1" 301 286 "-" "-" 20.48.179.39 - - [29/Aug/2026:16:23:36 +1000] "GET /wp-content/themes/gaukingo/ HTTP/1.1" 301 303 "-" "-" 20.48.179.39 - - [29/Aug/2026:16:23:37 +1000] "GET /wp-includes/ID3/moon.php HTTP/1.1" 301 300 "-" "-" 20.48.179.39 - - [29/Aug/2026:16:23:37 +1000] "GET /xmini4.php HTTP/1.1" 301 286 "-" "-" 20.48.179.39 - - [29/Aug/2026:16:23:38 +1000] "GET /gulu.php HTTP/1.1" 301 284 "-" "-" 20.48.179.39 - - [29/Aug/2026:16:23:38 +1000] "GET /replace.php HTTP/1.1" 301 287 "-" "-" == aaa/aaadownunder.com.au-ssl_log == -- top paths -- 2 POST /wp-login.php 2 POST /wp-cron.php 2 GET /wp-login.php 2 GET /goods.php 1 GET /zoo2.php 1 GET /zoo1.php 1 GET /xty.php 1 GET /x.php 1 GET /wsd.php 1 GET /ws85.php 1 GET /ws55.php 1 GET /wp.php -- last 10 requests -- 20.48.179.39 - - [29/Aug/2026:16:23:21 +1000] "GET /wp-admin/w.php HTTP/1.1" 404 - "-" "-" 20.48.179.39 - - [29/Aug/2026:16:23:22 +1000] "GET /wp-content/k.php HTTP/1.1" 404 - "-" "-" 20.48.179.39 - - [29/Aug/2026:16:23:22 +1000] "GET /os.php HTTP/1.1" 404 - "-" "-" 20.48.179.39 - - [29/Aug/2026:16:23:22 +1000] "GET /htio.php HTTP/1.1" 404 - "-" "-" 20.48.179.39 - - [29/Aug/2026:16:23:23 +1000] "GET /dev.php?p HTTP/1.1" 404 - "-" "-" 20.48.179.39 - - [29/Aug/2026:16:23:23 +1000] "GET /gos.php HTTP/1.1" 404 - "-" "-" 20.48.179.39 - - [29/Aug/2026:16:23:24 +1000] "GET /132.php HTTP/1.1" 404 - "-" "-" 20.48.179.39 - - [29/Aug/2026:16:23:24 +1000] "GET /v22.php HTTP/1.1" 404 - "-" "-" 118.127.40.55 - - [29/Aug/2026:16:23:25 +1000] "POST /wp-cron.php?doing_wp_cron=1787984605.4483330249786376953125 HTTP/1.1" 200 1 "-" "WordPress/7.1; https://aaadownunder.com.au" 20.48.179.39 - - [29/Aug/2026:16:23:25 +1000] "GET /wp-activate.php HTTP/1.1" 302 - "-" "-" == candyfabcom/candyfab.com.au-ssl_log == -- top paths -- 2 GET /goods.php 1 GET /zoo2.php 1 GET /zoo1.php 1 GET /xty.php 1 GET /x.php 1 GET /wsd.php 1 GET /ws85.php 1 GET /ws55.php 1 GET /wp-trackback.php 1 GET /wp-safe.php 1 GET /wp.php 1 GET /wp-includes/index.php -- last 10 requests -- 20.151.129.194 - - [29/Aug/2026:16:22:51 +1000] "GET /gjewuagf.php HTTP/1.1" 401 36 "-" "-" 20.151.129.194 - - [29/Aug/2026:16:22:52 +1000] "GET /tnglzqmv.php HTTP/1.1" 401 36 "-" "-" 20.151.129.194 - - [29/Aug/2026:16:22:52 +1000] "GET /wefile.php HTTP/1.1" 401 36 "-" "-" 20.151.129.194 - - [29/Aug/2026:16:22:53 +1000] "GET /blog.php HTTP/1.1" 401 36 "-" "-" 20.151.129.194 - - [29/Aug/2026:16:22:53 +1000] "GET /wp-admin/js/wp-load.php HTTP/1.1" 401 36 "-" "-" 20.151.129.194 - - [29/Aug/2026:16:22:54 +1000] "GET /robot.php HTTP/1.1" 401 36 "-" "-" 20.151.129.194 - - [29/Aug/2026:16:22:54 +1000] "GET /revo.php HTTP/1.1" 401 36 "-" "-" 20.151.129.194 - - [29/Aug/2026:16:22:55 +1000] "GET /birrs.php HTTP/1.1" 401 36 "-" "-" 20.151.129.194 - - [29/Aug/2026:16:22:55 +1000] "GET /sss.php HTTP/1.1" 401 36 "-" "-" 20.151.129.194 - - [29/Aug/2026:16:22:55 +1000] "GET /wp-content/themes/gaukingo/ HTTP/1.1" 401 36 "-" "-" --- last 30 samples (run-up to this incident) --- 2026-08-29 16:22:05 L1=0.39 run=1 blk=0 avail=8293 (60.2%) swpO=0 conn=1 myRSS=2734 php=2 phpRSS=41 ap=80 tcp=127 topuser=root 2026-08-29 16:22:12 L1=0.60 run=2 blk=0 avail=7503 (54.5%) swpO=0 conn=1 myRSS=2734 php=5 phpRSS=490 ap=139 tcp=54 topuser=madalice 2026-08-29 16:22:15 L1=0.55 run=3 blk=0 avail=7491 (54.4%) swpO=0 conn=1 myRSS=2734 php=6 phpRSS=549 ap=137 tcp=32 topuser=madalice 2026-08-29 16:22:22 L1=0.59 run=2 blk=0 avail=7571 (55.0%) swpO=0 conn=1 myRSS=2734 php=5 phpRSS=490 ap=129 tcp=28 topuser=madalice 2026-08-29 16:22:25 L1=0.54 run=1 blk=0 avail=7591 (55.1%) swpO=0 conn=1 myRSS=2734 php=5 phpRSS=490 ap=126 tcp=30 topuser=madalice 2026-08-29 16:22:32 L1=0.66 run=3 blk=0 avail=7601 (55.2%) swpO=0 conn=1 myRSS=2734 php=5 phpRSS=401 ap=119 tcp=26 topuser=olympic 2026-08-29 16:22:35 L1=0.85 run=3 blk=0 avail=7898 (57.3%) swpO=0 conn=1 myRSS=2734 php=3 phpRSS=200 ap=116 tcp=54 topuser=madalice 2026-08-29 16:22:42 L1=0.78 run=1 blk=0 avail=7940 (57.6%) swpO=0 conn=1 myRSS=2734 php=3 phpRSS=200 ap=109 tcp=29 topuser=madalice 2026-08-29 16:22:45 L1=0.72 run=1 blk=0 avail=7963 (57.8%) swpO=0 conn=1 myRSS=2734 php=3 phpRSS=200 ap=106 tcp=30 topuser=madalice 2026-08-29 16:22:52 L1=0.74 run=1 blk=0 avail=8024 (58.2%) swpO=0 conn=1 myRSS=2734 php=3 phpRSS=200 ap=99 tcp=25 topuser=madalice 2026-08-29 16:22:55 L1=0.68 run=4 blk=0 avail=8035 (58.3%) swpO=0 conn=1 myRSS=2734 php=3 phpRSS=217 ap=96 tcp=27 topuser=madalice 2026-08-29 16:23:02 L1=0.62 run=4 blk=0 avail=7866 (57.1%) swpO=0 conn=1 myRSS=2734 php=5 phpRSS=366 ap=89 tcp=29 topuser=madalice 2026-08-29 16:23:05 L1=0.57 run=2 blk=0 avail=7834 (56.9%) swpO=0 conn=1 myRSS=2734 php=5 phpRSS=512 ap=86 tcp=27 topuser=madalice 2026-08-29 16:23:13 L1=0.69 run=1 blk=0 avail=7874 (57.2%) swpO=0 conn=1 myRSS=2734 php=5 phpRSS=512 ap=79 tcp=25 topuser=madalice 2026-08-29 16:23:15 L1=0.63 run=5 blk=0 avail=7790 (56.5%) swpO=0 conn=1 myRSS=2734 php=7 phpRSS=680 ap=76 tcp=31 topuser=madalice 2026-08-29 16:23:23 L1=0.66 run=3 blk=0 avail=7951 (57.7%) swpO=0 conn=1 myRSS=2734 php=6 phpRSS=548 ap=69 tcp=25 topuser=madalice 2026-08-29 16:23:25 L1=0.61 run=4 blk=0 avail=7866 (57.1%) swpO=0 conn=1 myRSS=2734 php=7 phpRSS=675 ap=66 tcp=30 topuser=madalice 2026-08-29 16:23:33 L1=0.72 run=4 blk=0 avail=7832 (56.8%) swpO=0 conn=1 myRSS=2734 php=6 phpRSS=719 ap=60 tcp=105 topuser=madalice 2026-08-29 16:23:35 L1=0.74 run=1 blk=0 avail=7869 (57.1%) swpO=0 conn=1 myRSS=2734 php=5 phpRSS=560 ap=74 tcp=109 topuser=madalice 2026-08-29 16:23:43 L1=0.68 run=5 blk=0 avail=7689 (55.8%) swpO=0 conn=1 myRSS=2734 php=7 phpRSS=732 ap=85 tcp=29 topuser=madalice 2026-08-29 16:23:45 L1=0.71 run=2 blk=0 avail=7777 (56.4%) swpO=0 conn=1 myRSS=2734 php=6 phpRSS=636 ap=82 tcp=25 topuser=madalice 2026-08-29 16:23:53 L1=0.73 run=4 blk=0 avail=7730 (56.1%) swpO=0 conn=3 myRSS=2734 php=9 phpRSS=817 ap=75 tcp=27 topuser=madalice 2026-08-29 16:23:55 L1=0.75 run=2 blk=0 avail=7824 (56.8%) swpO=0 conn=1 myRSS=2734 php=6 phpRSS=663 ap=72 tcp=24 topuser=madalice 2026-08-29 16:24:03 L1=0.77 run=2 blk=0 avail=8170 (59.3%) swpO=0 conn=3 myRSS=2734 php=4 phpRSS=334 ap=65 tcp=23 topuser=madalice 2026-08-29 16:24:05 L1=0.79 run=3 blk=0 avail=8122 (59.0%) swpO=0 conn=1 myRSS=2734 php=5 phpRSS=433 ap=62 tcp=24 topuser=alison 2026-08-29 16:24:13 L1=0.89 run=2 blk=1 avail=8329 (60.5%) swpO=0 conn=3 myRSS=2734 php=3 phpRSS=213 ap=55 tcp=21 topuser=madalice 2026-08-29 16:24:15 L1=0.90 run=4 blk=0 avail=8259 (59.9%) swpO=0 conn=1 myRSS=2734 php=6 phpRSS=397 ap=52 tcp=26 topuser=madalice 2026-08-29 16:24:23 L1=0.91 run=2 blk=0 avail=8357 (60.7%) swpO=0 conn=3 myRSS=2734 php=4 phpRSS=283 ap=45 tcp=23 topuser=madalice 2026-08-29 16:24:25 L1=1.08 run=2 blk=0 avail=7820 (56.8%) swpO=0 conn=1 myRSS=2734 php=9 phpRSS=940 ap=42 tcp=40 topuser=madalice 2026-08-29 16:24:33 L1=1.07 run=10 blk=0 avail=7319 (53.1%) swpO=3 conn=10 myRSS=2734 php=11 phpRSS=1559 ap=36 tcp=43 topuser=madalice