INCIDENT 2026-08-30 11:15:04 trigger: php_rss=2054MB ================================================================== load: 0.86 0.59 0.78 8/684 4080748 ncpu:10 mem_avail: 6601MB/13777MB (47.9%) swap_used:1820MB swapout:0/s blocked(D):0 running:12 iowait:0.1% steal:0.0% php: 16 procs / 2054MB heaviest user: madalice (10 procs, 1830MB) apache: 46 procs tcp_estab: 51 --- RSS by user (all processes) --- USER PROCS RSS_MB mysql 1 2926 madalice 10 1855 root 255 1162 nobody 45 763 netdata 7 198 evolution 10 176 mailman 20 121 dovenull 6 46 cpanellogin 1 46 wp-toolkit 3 31 kurri 2 26 mailnull 1 24 zabbix 1 21 dovecot 3 19 named 1 15 aaa 1 15 alison 1 14 polkitd 1 5 nscd 1 4 cpanelconnecttrack 1 3 --- php workers by user --- USER PROCS RSS_MB madalice 10 1864 evolution 5 195 root 1 22 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 5275 MB Active(file): 4733 MB Inactive(file): 971 MB Dirty: 152 MB Writeback: 0 MB SReclaimable: 608 MB CommitLimit: 10984 MB Committed_AS: 9487 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 489033 root 2-08:56:24 7704 /usr/bin/imunify-agent-proxy 4079432 root 00:02 2976 /bin/sh -c bash -c 'sleep $((RANDOM % 60))' ; /opt/imunify360/venv/share/imunify360/scripts/check-detached.py > /dev/null 2>&1 || : --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 506671 1 mysql 2996712 7.4 Ssl 2-08:55:53 /usr/sbin/mariadbd 4079360 510022 madalice 245728 53.5 R 00:09 php-fpm: pool madalice_com_au 2328310 2277352 root 214760 0.0 S 08:36:53 spamd child 508924 1 netdata 178320 1.9 Ssl 2-08:55:22 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 2277352 1 root 175580 0.0 Ss 08:51:59 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 -- 2328311 2277352 root 167656 0.0 S 08:36:53 spamd child 4079146 510022 madalice 164756 20.5 R 00:39 php-fpm: pool madalice_com_au 4079172 510022 madalice 163156 17.4 R 00:34 php-fpm: pool madalice_com_au 4079140 510022 madalice 160596 20.5 S 00:39 php-fpm: pool madalice_com_au 4079141 510022 madalice 159684 17.4 S 00:39 php-fpm: pool madalice_com_au 4079145 510022 madalice 159684 17.4 S 00:39 php-fpm: pool madalice_com_au 4079363 510022 madalice 159548 42.7 S 00:08 php-fpm: pool madalice_com_au 4079384 510022 madalice 159496 51.6 S 00:05 php-fpm: pool madalice_com_au 4079385 510022 madalice 159496 49.6 S 00:05 php-fpm: pool madalice_com_au 4079361 510022 madalice 159060 40.5 S 00:09 php-fpm: pool madalice_com_au 509266 1 root 146848 0.0 Ss 2-08:55:19 /usr/lib/systemd/systemd-journald 4079471 4079429 evolution 70120 9.5 Ss 00:02 /opt/cpanel/ea-php74/root/usr/bin/php-cgi /home/evolution/my.evolutionerp.com.au/cron/xero2.php 509236 509098 root 52920 0.0 Sl 2-08:55:19 /opt/saltstack/salt/bin/python3.10 /usr/bin/salt-minion MultiMinionProcessManager MinionProcessManager 509640 508992 root 48108 0.0 Sl 2-08:55:17 /usr/libexec/netdata/plugins.d/ebpf.plugin 1 4027958 1353308 cpanellogin 47384 0.0 S 16:50 /usr/local/cpanel/base/show_template.stor cpanel_locale docroot /usr/local/cpanel/base server_locale en default_login_theme cpanel 1353308 1 root 42208 0.1 Ss 39-08:33:45 cpsrvd (SSL) - waiting for connections 4080102 4079156 evolution 40700 0.0 S 00:00 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 4080126 4076791 evolution 40700 0.0 S 00:00 /opt/cpanel/ea-php74/root/usr/bin/php-cgi 2275833 1 root 35924 0.0 Ss 08:52:49 lfd - sleeping 508720 1 mailnull 25296 0.0 Ss 2-08:55:26 /usr/sbin/exim -ps -bd -q15m -oP /var/spool/exim/exim-daemon.pid 1469 1 root 24064 0.1 Ss 62-01:05:14 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 510022 1 root 23340 0.0 Ss 2-08:55:15 php-fpm: master process (/opt/cpanel/ea-php83/root/etc/php-fpm.conf) 4061532 506832 nobody 23252 0.0 S 06:50 /usr/sbin/httpd -k start 4061554 506832 nobody 22964 0.0 S 06:48 /usr/sbin/httpd -k start 1463 1 root 21968 0.0 Ss 62-01:05:14 tailwatchd 483898 1 zabbix 21696 0.2 Ssl 2-08:56:36 /usr/sbin/zabbix_agent2 -c /etc/zabbix/zabbix_agent2.conf 4062002 506832 nobody 21492 0.0 S 06:14 /usr/sbin/httpd -k start 4076791 506832 nobody 20304 0.0 S 03:59 /usr/sbin/httpd -k start 4077305 506832 nobody 20080 0.0 S 03:13 /usr/sbin/httpd -k start 4079151 506832 nobody 19636 0.0 S 00:37 /usr/sbin/httpd -k start 4079164 506832 nobody 19444 0.0 S 00:35 /usr/sbin/httpd -k start 4079147 506832 nobody 19404 0.0 S 00:38 /usr/sbin/httpd -k start 4079156 506832 nobody 19272 0.0 S 00:36 /usr/sbin/httpd -k start 4079382 506832 nobody 19196 0.2 S 00:05 /usr/sbin/httpd -k start 4079377 506832 nobody 19104 0.2 S 00:05 /usr/sbin/httpd -k start 4079379 506832 nobody 19044 0.2 S 00:05 /usr/sbin/httpd -k start 4079383 506832 nobody 19044 0.2 S 00:05 /usr/sbin/httpd -k start 4079381 506832 nobody 19040 0.2 S 00:05 /usr/sbin/httpd -k start 4079378 506832 nobody 18980 0.2 S 00:05 /usr/sbin/httpd -k start 4079380 506832 nobody 18952 0.2 S 00:05 /usr/sbin/httpd -k start 4079401 506832 nobody 18952 0.2 S 00:04 /usr/sbin/httpd -k start 4079371 506832 nobody 18908 0.3 S 00:06 /usr/sbin/httpd -k start 4077294 506832 nobody 18884 0.0 S 03:14 /usr/sbin/httpd -k start 4078732 506832 nobody 18672 0.0 S 01:14 /usr/sbin/httpd -k start 4078724 506832 nobody 18628 0.0 S 01:15 /usr/sbin/httpd -k start 4079165 506832 nobody 18572 0.0 S 00:35 /usr/sbin/httpd -k start 4079462 4079457 root 18076 1.0 S 00:02 /usr/local/cpanel/bin/dcpumon 938582 1 wp-toolkit 18068 0.0 Ss 2-07:02:56 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php 4079362 506832 nobody 17564 0.0 S 00:08 /usr/sbin/httpd -k start 4079367 506832 nobody 17444 0.0 S 00:07 /usr/sbin/httpd -k start 4079393 506832 nobody 17260 0.0 S 00:04 /usr/sbin/httpd -k start 1471 1 root 16996 0.0 Ss 62-01:05:14 cPhulkd - processor 4079389 506832 nobody 16992 0.0 S 00:04 /usr/sbin/httpd -k start 4079402 506832 nobody 16896 0.0 S 00:04 /usr/sbin/httpd -k start 3446928 1471 root 16812 0.0 S 03:09:14 cPhulkd - dbprocessor --- processes in D state (uninterruptible IO) --- --- mariadb processlist (non-sleeping) --- +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 4473615 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min evolution/legacy.evolutionerp.com.au 120 evolution/portal.evolutionerp.com.au-ssl_log 118 evolution/portal.evolutionerp.com.au 87 madalice/madalice.com.au-ssl_log 40 evolution/app.evolutionerp.com.au-ssl_log 34 infinium/infinium.net.au-ssl_log 6 whiz/whizengineering.com.au-ssl_log 2 (total vhosts taking traffic: 7) --- top client IPs across all vhosts (last 3 min) --- 181 20.63.81.20 120 68.155.159.216 35 47.129.61.99 34 40.115.94.245 24 203.54.180.238 2 20.48.250.41 2 192.250.232.93 2 118.127.40.55 2 114.119.137.101 1 91.92.243.251 1 50.6.169.131 1 114.119.159.70 1 114.119.146.16 1 114.119.143.104 --- top request paths across all vhosts (last 3 min) --- 24 GET /heartbeat.php 5 GET /store/hand-painted-nike-af1-wildroses/ 4 GET /wp-login.php 4 GET /wp-conffg.php 3 GET /wp-mail.php 3 GET /wp-content/plugins/hellopress/wp_filemanager.php 3 GET /this_is_a_new_hello_world.php 3 GET /simple.php 3 GET /radio.php 3 GET /goods.php 3 GET /classwithtostring.php 3 GET /about.php 3 GET /1.php 2 POST /wp-login.php 2 POST /wp-cron.php 2 GET /xmini4.php 2 GET /xl2023.php 2 GET /xcc.php 2 GET /wp_xiPu52Ut.php 2 GET /wp-ws68.php --- busiest 3 vhosts: top paths + last 10 requests --- == evolution/legacy.evolutionerp.com.au == -- top paths -- 2 GET /dropdown.php 1 GET /xmlrpc.php 1 GET /wzy.php 1 GET /ws.php 1 GET /wp-mail.php 1 GET /wp-login.php 1 GET /wp-l0gin.php 1 GET /wp-includes/widgets/index.php 1 GET /wp-includes/Text/index.php 1 GET /wp-includes/Text/Diff/index.php 1 GET /wp-includes/Text/about.php 1 GET /wp-includes/sitemaps/providers/index.php -- last 10 requests -- 68.155.159.216 - - [30/Aug/2026:11:14:02 +1000] "GET /wp-admin/setup-config.php HTTP/1.1" 404 - "-" "-" 68.155.159.216 - - [30/Aug/2026:11:14:02 +1000] "GET /wp-content/themes/themes/Cyb3r.php HTTP/1.1" 404 - "-" "-" 68.155.159.216 - - [30/Aug/2026:11:14:02 +1000] "GET /wp-content/plugins/plugins/Cyb3r.php HTTP/1.1" 404 - "-" "-" 68.155.159.216 - - [30/Aug/2026:11:14:02 +1000] "GET /wp-includes/SimplePie/about.php HTTP/1.1" 404 - "-" "-" 68.155.159.216 - - [30/Aug/2026:11:14:02 +1000] "GET /wp-includes/SimplePie/Content/index.php HTTP/1.1" 404 - "-" "-" 68.155.159.216 - - [30/Aug/2026:11:14:03 +1000] "GET /packed.php HTTP/1.1" 404 - "-" "-" 68.155.159.216 - - [30/Aug/2026:11:14:03 +1000] "GET /wp-content/packed.php HTTP/1.1" 404 - "-" "-" 68.155.159.216 - - [30/Aug/2026:11:14:03 +1000] "GET /wp-l0gin.php HTTP/1.1" 404 - "-" "-" 68.155.159.216 - - [30/Aug/2026:11:14:03 +1000] "GET /wp-content/plugins/google-seo-rank/module.php HTTP/1.1" 404 - "-" "-" 68.155.159.216 - - [30/Aug/2026:11:14:03 +1000] "GET /ioxi002.PhP7 HTTP/1.1" 404 - "-" "-" == evolution/portal.evolutionerp.com.au-ssl_log == -- top paths -- 24 GET /heartbeat.php 2 GET /wp-conffg.php 1 GET /xmini4.php 1 GET /xl2023.php 1 GET /xcc.php 1 GET /wp_xiPu52Ut.php 1 GET /wp-ws68.php 1 GET /wp-validate.php 1 GET /wp-tymanage.php 1 GET /wp-theme.php 1 GET /wp-signup.php 1 GET /wp-settings.php -- last 10 requests -- 203.54.180.238 - - [30/Aug/2026:11:14:53 +1000] "GET /heartbeat.php?sentAt=1788052493&bytes=106,147,132,13&_=1787897055900 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 203.54.180.238 - - [30/Aug/2026:11:14:53 +1000] "GET /heartbeat.php?sentAt=1788052493&bytes=106,147,132,13&_=1787918094385 HTTP/1.1" 200 10 "https://portal.evolutionerp.com.au/index.php?page=factory_proc_queue&process=6" 20.63.81.20 - - [30/Aug/2026:11:14:54 +1000] "GET /st.php HTTP/1.1" 404 - "-" "-" 20.63.81.20 - - [30/Aug/2026:11:14:55 +1000] "GET /alfanew.php HTTP/1.1" 404 - "-" "-" 20.63.81.20 - - [30/Aug/2026:11:14:55 +1000] "GET /ioxi.php HTTP/1.1" 404 - "-" "-" 20.63.81.20 - - [30/Aug/2026:11:14:55 +1000] "GET /TNT.php HTTP/1.1" 404 - "-" "-" 20.63.81.20 - - [30/Aug/2026:11:14:56 +1000] "GET /cd.php HTTP/1.1" 404 - "-" "-" 20.63.81.20 - - [30/Aug/2026:11:14:56 +1000] "GET /luuf.php HTTP/1.1" 404 - "-" "-" 20.63.81.20 - - [30/Aug/2026:11:14:57 +1000] "GET /fex.php HTTP/1.1" 404 - "-" "-" 20.63.81.20 - - [30/Aug/2026:11:14:57 +1000] "GET /l.php HTTP/1.1" 404 - "-" "-" == evolution/portal.evolutionerp.com.au == -- top paths -- 2 GET /wp-conffg.php 1 GET /xmini4.php 1 GET /xl2023.php 1 GET /xcc.php 1 GET /wp_xiPu52Ut.php 1 GET /wp-ws68.php 1 GET /wp-validate.php 1 GET /wp-tymanage.php 1 GET /wp-theme.php 1 GET /wp-signup.php 1 GET /wp-settings.php 1 GET /wp_n5VD7XDh.php -- last 10 requests -- 20.63.81.20 - - [30/Aug/2026:11:14:50 +1000] "GET /wp-easy.php HTTP/1.1" 301 298 "-" "-" 20.63.81.20 - - [30/Aug/2026:11:14:51 +1000] "GET /d7.php HTTP/1.1" 301 293 "-" "-" 20.63.81.20 - - [30/Aug/2026:11:14:51 +1000] "GET /v5.php HTTP/1.1" 301 293 "-" "-" 20.63.81.20 - - [30/Aug/2026:11:14:52 +1000] "GET /az.php HTTP/1.1" 301 293 "-" "-" 20.63.81.20 - - [30/Aug/2026:11:14:52 +1000] "GET /js.php HTTP/1.1" 301 293 "-" "-" 20.63.81.20 - - [30/Aug/2026:11:14:52 +1000] "GET /hd.php HTTP/1.1" 301 293 "-" "-" 20.63.81.20 - - [30/Aug/2026:11:14:53 +1000] "GET /xl2023.php HTTP/1.1" 301 297 "-" "-" 20.63.81.20 - - [30/Aug/2026:11:14:53 +1000] "GET /V2.php HTTP/1.1" 301 293 "-" "-" 20.63.81.20 - - [30/Aug/2026:11:14:54 +1000] "GET /mad.php HTTP/1.1" 301 294 "-" "-" 20.63.81.20 - - [30/Aug/2026:11:14:54 +1000] "GET /st.php HTTP/1.1" 301 293 "-" "-" --- last 30 samples (run-up to this incident) --- 2026-08-30 11:12:43 L1=0.43 run=1 blk=0 avail=8327 (60.4%) swpO=0 conn=2 myRSS=2926 php=4 phpRSS=230 ap=18 tcp=30 topuser=madalice 2026-08-30 11:12:44 L1=0.43 run=2 blk=0 avail=8319 (60.4%) swpO=0 conn=3 myRSS=2926 php=5 phpRSS=270 ap=18 tcp=29 topuser=madalice 2026-08-30 11:12:53 L1=0.45 run=3 blk=0 avail=8096 (58.8%) swpO=0 conn=2 myRSS=2926 php=7 phpRSS=559 ap=18 tcp=33 topuser=infinium 2026-08-30 11:12:54 L1=0.45 run=1 blk=0 avail=8324 (60.4%) swpO=0 conn=3 myRSS=2926 php=5 phpRSS=268 ap=18 tcp=30 topuser=madalice 2026-08-30 11:13:03 L1=0.46 run=2 blk=0 avail=8306 (60.3%) swpO=0 conn=2 myRSS=2926 php=5 phpRSS=269 ap=18 tcp=30 topuser=madalice 2026-08-30 11:13:04 L1=0.46 run=1 blk=0 avail=8290 (60.2%) swpO=0 conn=3 myRSS=2926 php=5 phpRSS=269 ap=18 tcp=28 topuser=madalice 2026-08-30 11:13:13 L1=0.53 run=1 blk=0 avail=8347 (60.6%) swpO=2 conn=2 myRSS=2926 php=5 phpRSS=269 ap=16 tcp=22 topuser=madalice 2026-08-30 11:13:14 L1=0.53 run=2 blk=0 avail=8344 (60.6%) swpO=2 conn=3 myRSS=2926 php=5 phpRSS=273 ap=16 tcp=22 topuser=madalice 2026-08-30 11:13:23 L1=0.45 run=1 blk=0 avail=8364 (60.7%) swpO=0 conn=3 myRSS=2926 php=5 phpRSS=271 ap=14 tcp=22 topuser=madalice 2026-08-30 11:13:24 L1=0.45 run=1 blk=0 avail=8362 (60.7%) swpO=0 conn=3 myRSS=2926 php=5 phpRSS=271 ap=14 tcp=22 topuser=madalice 2026-08-30 11:13:33 L1=0.38 run=1 blk=0 avail=8368 (60.7%) swpO=0 conn=3 myRSS=2926 php=5 phpRSS=271 ap=14 tcp=22 topuser=madalice 2026-08-30 11:13:34 L1=0.38 run=1 blk=0 avail=8367 (60.7%) swpO=0 conn=3 myRSS=2926 php=5 phpRSS=271 ap=14 tcp=22 topuser=madalice 2026-08-30 11:13:43 L1=0.32 run=1 blk=0 avail=8353 (60.6%) swpO=0 conn=3 myRSS=2926 php=5 phpRSS=271 ap=14 tcp=32 topuser=madalice 2026-08-30 11:13:44 L1=0.32 run=1 blk=0 avail=8350 (60.6%) swpO=0 conn=2 myRSS=2926 php=4 phpRSS=231 ap=14 tcp=33 topuser=madalice 2026-08-30 11:13:53 L1=0.35 run=2 blk=0 avail=8263 (60.0%) swpO=0 conn=3 myRSS=2926 php=6 phpRSS=348 ap=20 tcp=34 topuser=madalice 2026-08-30 11:13:54 L1=0.35 run=2 blk=0 avail=8206 (59.6%) swpO=0 conn=2 myRSS=2926 php=5 phpRSS=262 ap=20 tcp=34 topuser=madalice 2026-08-30 11:14:03 L1=0.45 run=1 blk=0 avail=8321 (60.4%) swpO=0 conn=3 myRSS=2926 php=5 phpRSS=270 ap=18 tcp=34 topuser=madalice 2026-08-30 11:14:04 L1=0.45 run=1 blk=0 avail=8334 (60.5%) swpO=0 conn=2 myRSS=2926 php=4 phpRSS=230 ap=18 tcp=33 topuser=madalice 2026-08-30 11:14:14 L1=0.38 run=1 blk=0 avail=8286 (60.1%) swpO=0 conn=3 myRSS=2926 php=5 phpRSS=270 ap=16 tcp=30 topuser=madalice 2026-08-30 11:14:14 L1=0.38 run=2 blk=0 avail=8295 (60.2%) swpO=0 conn=2 myRSS=2926 php=4 phpRSS=234 ap=16 tcp=31 topuser=madalice 2026-08-30 11:14:24 L1=0.40 run=1 blk=0 avail=8339 (60.5%) swpO=0 conn=3 myRSS=2926 php=5 phpRSS=271 ap=17 tcp=28 topuser=madalice 2026-08-30 11:14:24 L1=0.40 run=1 blk=0 avail=8363 (60.7%) swpO=0 conn=2 myRSS=2926 php=3 phpRSS=190 ap=17 tcp=32 topuser=madalice 2026-08-30 11:14:34 L1=0.42 run=1 blk=0 avail=7458 (54.1%) swpO=1 conn=3 myRSS=2926 php=11 phpRSS=1181 ap=31 tcp=40 topuser=madalice 2026-08-30 11:14:34 L1=0.42 run=1 blk=0 avail=7480 (54.3%) swpO=1 conn=2 myRSS=2926 php=9 phpRSS=1101 ap=31 tcp=40 topuser=madalice 2026-08-30 11:14:44 L1=0.35 run=1 blk=0 avail=7513 (54.5%) swpO=0 conn=3 myRSS=2926 php=11 phpRSS=1181 ap=23 tcp=26 topuser=madalice 2026-08-30 11:14:44 L1=0.35 run=1 blk=0 avail=7544 (54.8%) swpO=0 conn=1 myRSS=2926 php=9 phpRSS=1100 ap=23 tcp=24 topuser=madalice 2026-08-30 11:14:54 L1=0.38 run=1 blk=0 avail=7823 (56.8%) swpO=0 conn=3 myRSS=2926 php=9 phpRSS=869 ap=18 tcp=25 topuser=madalice 2026-08-30 11:14:54 L1=0.38 run=1 blk=0 avail=7847 (57.0%) swpO=0 conn=1 myRSS=2926 php=7 phpRSS=789 ap=18 tcp=25 topuser=madalice 2026-08-30 11:15:04 L1=0.86 run=12 blk=0 avail=6601 (47.9%) swpO=0 conn=10 myRSS=2926 php=16 phpRSS=2054 ap=46 tcp=51 topuser=madalice 2026-08-30 11:15:04 L1=0.86 run=15 blk=0 avail=6705 (48.7%) swpO=0 conn=13 myRSS=2926 php=13 phpRSS=1865 ap=47 tcp=58 topuser=madalice