INCIDENT 2026-08-29 16:25:34 trigger: php_rss=1801MB ================================================================== load: 1.42 1.01 0.98 2/657 184101 ncpu:10 mem_avail: 7202MB/13777MB (52.3%) swap_used:1486MB swapout:0/s blocked(D):0 running:2 iowait:0.2% steal:0.0% php: 15 procs / 1801MB heaviest user: madalice (10 procs, 1557MB) apache: 29 procs tcp_estab: 25 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2734 madalice 10 1557 root 249 1019 nobody 28 469 netdata 7 206 mailman 20 190 alison 1 126 evolution 9 106 cpanellogin 1 62 dovenull 6 55 wp-toolkit 3 43 kurri 2 28 zabbix 1 23 dovecot 3 22 named 1 16 lowrange 1 14 mailnull 1 8 polkitd 1 6 nscd 1 5 cpanelconnecttrack 1 4 --- php workers by user --- USER PROCS RSS_MB madalice 10 1557 alison 1 127 evolution 3 92 root 1 27 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 4564 MB Active(file): 4270 MB Inactive(file): 785 MB Dirty: 2 MB Writeback: 0 MB SReclaimable: 549 MB CommitLimit: 10984 MB Committed_AS: 8603 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 489033 root 1-14:06:54 7112 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 506671 1 mysql 2800508 9.3 Ssl 1-14:06:23 /usr/sbin/mariadbd 508924 1 netdata 185280 2.0 Ssl 1-14:05:52 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 169564 510022 madalice 162640 10.9 S 01:11 php-fpm: pool madalice_com_au 1502904 1451906 root 161224 0.0 S 13:49:12 spamd child 170054 510022 madalice 159924 10.3 S 00:35 php-fpm: pool madalice_com_au 170056 510022 madalice 159876 9.9 S 00:35 php-fpm: pool madalice_com_au 170059 510022 madalice 159552 7.2 S 00:34 php-fpm: pool madalice_com_au 169567 510022 madalice 159456 9.6 S 01:11 php-fpm: pool madalice_com_au 169565 510022 madalice 159364 9.7 S 01:11 php-fpm: pool madalice_com_au 169601 510022 madalice 159036 7.6 S 01:02 php-fpm: pool madalice_com_au 170058 510022 madalice 159008 6.9 S 00:34 php-fpm: pool madalice_com_au 170055 510022 madalice 158424 9.5 S 00:35 php-fpm: pool madalice_com_au 169602 510022 madalice 157912 7.0 S 01:02 php-fpm: pool madalice_com_au 83639 1451906 root 147364 0.0 S 28:00 spamd child 184067 167835 alison 135448 96.0 R 00:01 /opt/cpanel/ea-php82/root/usr/bin/php-cgi 1451906 1 root 132116 0.0 Ss 14:02:27 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 509266 1 root 107536 0.0 Ss 1-14:05:49 /usr/lib/systemd/systemd-journald 509236 509098 root 64304 0.0 Sl 1-14:05:49 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 133529 1353308 cpanellogin 63532 0.0 S 13:52 /usr/local/cpanel/base/show_template.stor docroot /usr/local/cpanel/base cpanel_locale default_login_theme cpanel server_locale en 1353308 1 root 42372 0.1 Ss 38-13:44:15 cpsrvd (SSL) - waiting for connections 184068 169242 evolution 40496 3.0 S 00:01 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 184069 169236 evolution 40412 2.0 S 00:01 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 509640 508992 root 37616 0.0 Sl 1-14:05:47 /usr/libexec/netdata/plugins.d/ebpf.plugin 1 1451116 1 root 33368 0.0 Ss 14:03:20 lfd - sleeping 510022 1 root 28324 0.0 Ss 1-14:05:45 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 938582 1 wp-toolkit 25652 0.0 Ss 1-12:13:26 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 167665 506832 nobody 24864 0.0 S 03:34 /usr/sbin/httpd -k start 483898 1 zabbix 23768 0.2 Ssl 1-14:07:06 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 1469 1 root 22400 0.1 Ss 61-06:15:44 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 169242 506832 nobody 22060 0.0 S 01:58 /usr/sbin/httpd -k start 169236 506832 nobody 21396 0.0 S 01:58 /usr/sbin/httpd -k start 1463 1 root 21388 0.0 Ss 61-06:15:44 tailwatchd 167745 506832 nobody 21368 0.0 S 03:31 /usr/sbin/httpd -k start 169199 506832 nobody 20764 0.0 S 01:59 /usr/sbin/httpd -k start 167756 506832 nobody 20756 0.0 S 03:31 /usr/sbin/httpd -k start 169235 506832 nobody 20664 0.0 S 01:58 /usr/sbin/httpd -k start 169244 506832 nobody 20560 0.0 S 01:58 /usr/sbin/httpd -k start 169886 506832 nobody 20540 0.0 S 00:59 /usr/sbin/httpd -k start 167835 506832 nobody 20128 0.1 S 03:30 /usr/sbin/httpd -k start 183982 506832 nobody 18992 0.0 S 00:14 /usr/sbin/httpd -k start 183096 506832 nobody 18920 0.0 S 00:23 /usr/sbin/httpd -k start 183991 506832 nobody 17776 0.0 S 00:13 /usr/sbin/httpd -k start 167821 506832 nobody 17432 0.0 S 03:30 /usr/sbin/httpd -k start 508634 1 named 17400 0.0 Ssl 1-14:05:57 /usr/sbin/pdns_server --socket-dir=/run/pdns --guardian=no --daemon=no --disable-syslog --log-timestamp=no --write-pid=no 183988 506832 nobody 17276 0.0 S 00:13 /usr/sbin/httpd -k start 183980 506832 nobody 17240 0.0 S 00:14 /usr/sbin/httpd -k start 183981 506832 nobody 17208 0.0 S 00:14 /usr/sbin/httpd -k start 183989 506832 nobody 17204 0.0 S 00:13 /usr/sbin/httpd -k start 183992 506832 nobody 17204 0.0 S 00:13 /usr/sbin/httpd -k start 509671 508992 netdata 17068 2.1 Sl 1-14:05:47 /usr/libexec/netdata/plugins.d/apps.plugin 1 183993 506832 nobody 17012 0.0 S 00:13 /usr/sbin/httpd -k start 183973 506832 nobody 16752 0.0 S 00:16 /usr/sbin/httpd -k start 183975 506832 nobody 16692 0.0 S 00:15 /usr/sbin/httpd -k start 183976 506832 nobody 16692 0.0 S 00:15 /usr/sbin/httpd -k start 183987 506832 nobody 16692 0.0 S 00:13 /usr/sbin/httpd -k start 938585 1 wp-toolkit 16232 0.0 Ss 1-12:13:26 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php 2766563 1471 root 16228 0.0 S 07:47:46 cPhulkd - dbprocessor 1471 1 root 16036 0.0 Ss 61-06:15:44 cPhulkd - processor 175797 506832 nobody 15312 0.0 S 00:28 /usr/sbin/httpd -k start 15553 508511 kurri 15136 0.0 S 46:45 dovecot/imap --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 4097878 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min alison/alisonarts.com.au-ssl_log 100 aaa/aaadownunder.com.au-ssl_log 94 aaa/aaadownunder.com.au 80 alison/alisonarts.com.au 50 madalice/madalice.com.au-ssl_log 49 evolution/portal.evolutionerp.com.au-ssl_log 27 corpkicks/corporatekicks.com.au-ssl_log 5 infinium/infinium.net.au-ssl_log 3 vinesit/vinesit.com.au-ssl_log 1 (total vhosts taking traffic: 9) --- top client IPs across all vhosts (last 3 min) --- 280 20.48.179.39 34 52.139.37.240 27 203.54.180.238 27 13.229.119.94 12 2a02:26f7:e48c:5704:0:a000:0:6 7 118.127.40.55 4 160.250.130.168 2 34.196.51.17 2 34.14.60.202 2 187.15.118.118 2 114.119.143.104 1 91.92.243.239 1 40.88.21.235 1 2001:8004:14b3:854f:559c:2fd0:fdd3:74b2 1 149.118.56.192 --- top request paths across all vhosts (last 3 min) --- 27 GET /heartbeat.php 7 POST / 7 GET /wp-login.php 7 GET / 5 POST /wp-cron.php 5 GET /store/hand-painted-nike-af1-wildroses/ 4 POST /wp-login.php 4 GET /goods.php 3 GET /zoo1.php 3 GET /ws85.php 3 GET /m.php 3 GET /k.php 3 GET /fling.php 3 GET /checkout-2/ 3 GET /admin.php 3 GET /1.php 2 POST /wp-admin/admin-ajax.php 2 HEAD / 2 GET /zoo2.php 2 GET /xty.php --- busiest 3 vhosts: top paths + last 10 requests --- == alison/alisonarts.com.au-ssl_log == -- top paths -- 2 GET /zoo1.php 2 GET /xty.php 2 GET /ws85.php 2 GET /m.php 2 GET /k.php 2 GET /fling.php 2 GET /admin.php 2 GET /1.php 1 POST /wp-login.php 1 POST / 1 GET /zoo2.php 1 GET /y.php -- last 10 requests -- 20.48.179.39 - - [29/Aug/2026:16:24:54 +1000] "GET /ffs.php HTTP/1.1" 404 49417 "-" "-" 20.48.179.39 - - [29/Aug/2026:16:24:56 +1000] "GET /nano.php HTTP/1.1" 404 49417 "-" "-" 20.48.179.39 - - [29/Aug/2026:16:24:58 +1000] "GET /ano.php HTTP/1.1" 404 49417 "-" "-" 20.48.179.39 - - [29/Aug/2026:16:25:00 +1000] "GET /mgrr.php HTTP/1.1" 404 49417 "-" "-" 20.48.179.39 - - [29/Aug/2026:16:25:03 +1000] "GET /mac.php HTTP/1.1" 404 49417 "-" "-" 20.48.179.39 - - [29/Aug/2026:16:25:05 +1000] "GET /simple.php HTTP/1.1" 404 49417 "-" "-" 20.48.179.39 - - [29/Aug/2026:16:25:07 +1000] "GET /xty.php?p= HTTP/1.1" 301 - "-" "-" 20.48.179.39 - - [29/Aug/2026:16:25:08 +1000] "GET /xty.php HTTP/1.1" 404 49417 "-" "-" 20.48.179.39 - - [29/Aug/2026:16:25:10 +1000] "GET /sallu.php HTTP/1.1" 404 49417 "-" "-" 20.48.179.39 - - [29/Aug/2026:16:25:13 +1000] "GET /codex.php HTTP/1.1" 404 49417 "-" "-" == aaa/aaadownunder.com.au-ssl_log == -- top paths -- 5 GET /wp-login.php 3 POST /wp-cron.php 2 POST /wp-login.php 2 GET /goods.php 1 GET /x.php 1 GET /xmini4.php 1 GET /ws55.php 1 GET /wp-trackback.php 1 GET /wp-safe.php 1 GET /wp.php 1 GET /wp-includes/index.php 1 GET /wp-includes/ID3/moon.php -- last 10 requests -- 20.48.179.39 - - [29/Aug/2026:16:23:38 +1000] "GET /replace.php HTTP/1.1" 404 - "-" "-" 20.48.179.39 - - [29/Aug/2026:16:23:39 +1000] "GET /c4.php HTTP/1.1" 404 - "-" "-" 20.48.179.39 - - [29/Aug/2026:16:23:39 +1000] "GET /rxr.php HTTP/1.1" 404 - "-" "-" 20.48.179.39 - - [29/Aug/2026:16:24:09 +1000] "-" 408 - "-" "-" 160.250.130.168 - - [29/Aug/2026:16:24:15 +1000] "GET /wp-login.php HTTP/1.1" 200 1940 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36" 118.127.40.55 - - [29/Aug/2026:16:24:16 +1000] "POST /wp-cron.php?doing_wp_cron=1787984656.2825179100036621093750 HTTP/1.1" 200 1 "-" "WordPress/7.1; https://aaadownunder.com.au" 160.250.130.168 - - [29/Aug/2026:16:24:15 +1000] "GET /wp-login.php HTTP/1.1" 200 1940 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36" 160.250.130.168 - - [29/Aug/2026:16:24:16 +1000] "POST /wp-login.php HTTP/1.1" 200 2054 "https://mail.aaadownunder.com.au/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Ch 160.250.130.168 - - [29/Aug/2026:16:24:17 +1000] "POST /wp-login.php HTTP/1.1" 200 2056 "https://mail.aaadownunder.com.au/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Ch 149.118.56.192 - - [29/Aug/2026:16:24:36 +1000] "GET /wp-login.php HTTP/1.1" 400 44 "https://www.facebook.com/" "Mozilla/5.0 (Windows NT 11.0; Win64; x64; rv:119.0) Gecko/20100101 Firefox/119.0" == aaa/aaadownunder.com.au == -- top paths -- 2 GET /goods.php 1 GET /x.php 1 GET /xmini4.php 1 GET /ws55.php 1 GET /wp-trackback.php 1 GET /wp-safe.php 1 GET /wp.php 1 GET /wp-includes/index.php 1 GET /wp-includes/ID3/moon.php 1 GET /w.php 1 GET /wp-content/uploads/ 1 GET /wp-content/themes/gaukingo/ -- last 10 requests -- 20.48.179.39 - - [29/Aug/2026:16:23:34 +1000] "GET /wp-admin/js/wp-load.php HTTP/1.1" 301 299 "-" "-" 20.48.179.39 - - [29/Aug/2026:16:23:35 +1000] "GET /robot.php HTTP/1.1" 301 285 "-" "-" 20.48.179.39 - - [29/Aug/2026:16:23:35 +1000] "GET /revo.php HTTP/1.1" 301 284 "-" "-" 20.48.179.39 - - [29/Aug/2026:16:23:35 +1000] "GET /birrs.php HTTP/1.1" 301 285 "-" "-" 20.48.179.39 - - [29/Aug/2026:16:23:36 +1000] "GET /sss.php?p= HTTP/1.1" 301 286 "-" "-" 20.48.179.39 - - [29/Aug/2026:16:23:36 +1000] "GET /wp-content/themes/gaukingo/ HTTP/1.1" 301 303 "-" "-" 20.48.179.39 - - [29/Aug/2026:16:23:37 +1000] "GET /wp-includes/ID3/moon.php HTTP/1.1" 301 300 "-" "-" 20.48.179.39 - - [29/Aug/2026:16:23:37 +1000] "GET /xmini4.php HTTP/1.1" 301 286 "-" "-" 20.48.179.39 - - [29/Aug/2026:16:23:38 +1000] "GET /gulu.php HTTP/1.1" 301 284 "-" "-" 20.48.179.39 - - [29/Aug/2026:16:23:38 +1000] "GET /replace.php HTTP/1.1" 301 287 "-" "-" --- last 30 samples (run-up to this incident) --- 2026-08-29 16:23:05 L1=0.57 run=2 blk=0 avail=7834 (56.9%) swpO=0 conn=1 myRSS=2734 php=5 phpRSS=512 ap=86 tcp=27 topuser=madalice 2026-08-29 16:23:13 L1=0.69 run=1 blk=0 avail=7874 (57.2%) swpO=0 conn=1 myRSS=2734 php=5 phpRSS=512 ap=79 tcp=25 topuser=madalice 2026-08-29 16:23:15 L1=0.63 run=5 blk=0 avail=7790 (56.5%) swpO=0 conn=1 myRSS=2734 php=7 phpRSS=680 ap=76 tcp=31 topuser=madalice 2026-08-29 16:23:23 L1=0.66 run=3 blk=0 avail=7951 (57.7%) swpO=0 conn=1 myRSS=2734 php=6 phpRSS=548 ap=69 tcp=25 topuser=madalice 2026-08-29 16:23:25 L1=0.61 run=4 blk=0 avail=7866 (57.1%) swpO=0 conn=1 myRSS=2734 php=7 phpRSS=675 ap=66 tcp=30 topuser=madalice 2026-08-29 16:23:33 L1=0.72 run=4 blk=0 avail=7832 (56.8%) swpO=0 conn=1 myRSS=2734 php=6 phpRSS=719 ap=60 tcp=105 topuser=madalice 2026-08-29 16:23:35 L1=0.74 run=1 blk=0 avail=7869 (57.1%) swpO=0 conn=1 myRSS=2734 php=5 phpRSS=560 ap=74 tcp=109 topuser=madalice 2026-08-29 16:23:43 L1=0.68 run=5 blk=0 avail=7689 (55.8%) swpO=0 conn=1 myRSS=2734 php=7 phpRSS=732 ap=85 tcp=29 topuser=madalice 2026-08-29 16:23:45 L1=0.71 run=2 blk=0 avail=7777 (56.4%) swpO=0 conn=1 myRSS=2734 php=6 phpRSS=636 ap=82 tcp=25 topuser=madalice 2026-08-29 16:23:53 L1=0.73 run=4 blk=0 avail=7730 (56.1%) swpO=0 conn=3 myRSS=2734 php=9 phpRSS=817 ap=75 tcp=27 topuser=madalice 2026-08-29 16:23:55 L1=0.75 run=2 blk=0 avail=7824 (56.8%) swpO=0 conn=1 myRSS=2734 php=6 phpRSS=663 ap=72 tcp=24 topuser=madalice 2026-08-29 16:24:03 L1=0.77 run=2 blk=0 avail=8170 (59.3%) swpO=0 conn=3 myRSS=2734 php=4 phpRSS=334 ap=65 tcp=23 topuser=madalice 2026-08-29 16:24:05 L1=0.79 run=3 blk=0 avail=8122 (59.0%) swpO=0 conn=1 myRSS=2734 php=5 phpRSS=433 ap=62 tcp=24 topuser=alison 2026-08-29 16:24:13 L1=0.89 run=2 blk=1 avail=8329 (60.5%) swpO=0 conn=3 myRSS=2734 php=3 phpRSS=213 ap=55 tcp=21 topuser=madalice 2026-08-29 16:24:15 L1=0.90 run=4 blk=0 avail=8259 (59.9%) swpO=0 conn=1 myRSS=2734 php=6 phpRSS=397 ap=52 tcp=26 topuser=madalice 2026-08-29 16:24:23 L1=0.91 run=2 blk=0 avail=8357 (60.7%) swpO=0 conn=3 myRSS=2734 php=4 phpRSS=283 ap=45 tcp=23 topuser=madalice 2026-08-29 16:24:25 L1=1.08 run=2 blk=0 avail=7820 (56.8%) swpO=0 conn=1 myRSS=2734 php=9 phpRSS=940 ap=42 tcp=40 topuser=madalice 2026-08-29 16:24:33 L1=1.07 run=10 blk=0 avail=7319 (53.1%) swpO=3 conn=10 myRSS=2734 php=11 phpRSS=1559 ap=36 tcp=43 topuser=madalice 2026-08-29 16:24:35 L1=1.14 run=3 blk=0 avail=7500 (54.4%) swpO=3 conn=2 myRSS=2734 php=11 phpRSS=1329 ap=38 tcp=49 topuser=madalice 2026-08-29 16:24:44 L1=1.13 run=1 blk=0 avail=7526 (54.6%) swpO=0 conn=10 myRSS=2734 php=12 phpRSS=1340 ap=37 tcp=24 topuser=madalice 2026-08-29 16:24:46 L1=1.76 run=1 blk=0 avail=7564 (54.9%) swpO=0 conn=2 myRSS=2734 php=10 phpRSS=1259 ap=35 tcp=24 topuser=madalice 2026-08-29 16:24:54 L1=1.70 run=2 blk=0 avail=7606 (55.2%) swpO=0 conn=3 myRSS=2734 php=12 phpRSS=1338 ap=27 tcp=25 topuser=madalice 2026-08-29 16:24:56 L1=1.56 run=1 blk=0 avail=7934 (57.6%) swpO=0 conn=2 myRSS=2734 php=8 phpRSS=929 ap=25 tcp=24 topuser=madalice 2026-08-29 16:25:04 L1=1.60 run=3 blk=0 avail=7346 (53.3%) swpO=0 conn=4 myRSS=2734 php=15 phpRSS=1650 ap=27 tcp=37 topuser=madalice 2026-08-29 16:25:06 L1=1.55 run=16 blk=0 avail=7380 (53.6%) swpO=0 conn=12 myRSS=2734 php=13 phpRSS=1587 ap=27 tcp=40 topuser=madalice 2026-08-29 16:25:14 L1=1.59 run=2 blk=0 avail=7260 (52.7%) swpO=0 conn=3 myRSS=2734 php=15 phpRSS=1737 ap=29 tcp=24 topuser=madalice 2026-08-29 16:25:16 L1=1.54 run=1 blk=0 avail=7325 (53.2%) swpO=0 conn=1 myRSS=2734 php=12 phpRSS=1597 ap=27 tcp=24 topuser=madalice 2026-08-29 16:25:24 L1=1.50 run=3 blk=0 avail=7070 (51.3%) swpO=0 conn=5 myRSS=2734 php=16 phpRSS=1884 ap=39 tcp=43 topuser=madalice 2026-08-29 16:25:26 L1=1.46 run=3 blk=0 avail=7120 (51.7%) swpO=0 conn=2 myRSS=2734 php=13 phpRSS=1759 ap=37 tcp=33 topuser=madalice 2026-08-29 16:25:34 L1=1.42 run=2 blk=0 avail=7202 (52.3%) swpO=0 conn=4 myRSS=2734 php=15 phpRSS=1801 ap=29 tcp=25 topuser=madalice