INCIDENT 2026-09-02 20:17:50 trigger: mem_avail=1.0% load=103.52/10cpu swapout=11504/s php_procs=123 php_rss=10364MB mysql_conn=91 ================================================================== load: 184.66 101.32 42.25 185/939 309526 ncpu:10 mem_avail: 137MB/13777MB (1.0%) swap_used:4095MB swapout:11504/s blocked(D):9 running:177 iowait:10.4% steal:0.0% php: 123 procs / 10364MB heaviest user: customc (113 procs, 10262MB) apache: 135 procs tcp_estab: 38 --- RSS by user (all processes) --- USER PROCS RSS_MB customc 116 10282 mysql 1 1572 nobody 143 625 root 295 375 madalice 5 122 netdata 9 113 evolution 20 36 mailman 20 21 mailnull 6 19 infinium 2 19 zabbix 1 9 dovenull 6 7 wp-toolkit 3 6 tubesupplies 1 5 cpanellogin 1 4 dovecot 3 3 cpanelconnecttrack 1 2 named 1 1 dbus 1 1 rpc 1 0 --- php workers by user --- USER PROCS RSS_MB customc 116 10392 madalice 5 126 evolution 4 17 tubesupplies 1 6 root 1 0 --- vm tuning / memory pressure --- vm.swappiness 30 vm.vfs_cache_pressure 100 vm.min_free_kbytes 67584 vm.overcommit_memory 0 vm.overcommit_ratio 50 Cached: 454 MB Active(file): 255 MB Inactive(file): 215 MB Dirty: 64 MB Writeback: 0 MB SReclaimable: 170 MB CommitLimit: 10984 MB Committed_AS: 21596 MB --- backup / dump / scan processes (page-cache evictors) --- PID USER ELAPSED RSS_KB COMMAND 243603 root 21:15 96 /bin/sh -c bash -c 'sleep $((RANDOM % 1800))' ;imunify-antivirus imunify-patch subscriptions refresh > /dev/null 2>&1 309416 root 00:59 124 /bin/sh -c bash -c 'sleep $((RANDOM % 60))' ; /opt/imunify360/venv/share/imunify360/scripts/check-detached.py > /dev/null 2>&1 || : 3926885 root 1-17:58:48 1960 /usr/bin/imunify-agent-proxy --- top 60 by RSS --- PID PPID USER RSS %CPU STAT ELAPSED COMMAND 3238812 1 mysql 1553136 14.5 Ssl 06:07:03 /usr/sbin/mariadbd 309024 308261 customc 162272 2.9 R 04:20 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 309051 308656 customc 162088 1.6 S 04:18 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 309010 308942 customc 161964 2.6 S 04:21 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 309089 309056 customc 161352 2.4 R 04:17 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 309022 308652 customc 160792 3.1 R 04:20 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 309020 308811 customc 160456 2.6 S 04:21 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 309042 309035 customc 160136 1.7 S 04:19 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 309018 308630 customc 159596 2.6 R 04:21 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 309026 308812 customc 159536 3.4 Rl 04:20 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 309017 308248 customc 158644 2.2 S 04:21 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 309014 308937 customc 157392 2.5 D 04:21 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 309038 308665 customc 155612 2.7 R 04:19 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 309007 308653 customc 155176 2.3 R 04:21 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 308955 308658 customc 148328 1.8 D 04:23 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 308921 308206 customc 138252 2.6 S 04:25 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 308846 308659 customc 132732 1.7 S 04:30 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 309088 309055 customc 132636 1.7 R 04:17 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 308948 308925 customc 132208 1.7 D 04:23 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 309098 308187 customc 131940 2.6 R 04:16 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 308934 308629 customc 130296 2.5 R 04:24 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 308913 308902 customc 129380 1.6 R 04:25 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 309043 308765 customc 128116 2.4 D 04:19 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 309032 308272 customc 126512 1.6 R 04:20 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 308857 308202 customc 125544 2.2 D 04:28 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 309003 308189 customc 122616 1.8 R 04:22 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 308933 308657 customc 121668 2.9 R 04:24 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 309085 308190 customc 118824 2.4 R 04:17 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 309081 308832 customc 118436 1.8 R 04:17 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 309082 308633 customc 118400 2.4 R 04:17 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 309005 308205 customc 117980 1.5 S 04:21 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 309041 309036 customc 117656 2.4 S 04:19 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 309087 309053 customc 117264 1.7 R 04:17 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 309078 259198 customc 117160 2.4 R 04:17 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 309013 308939 customc 115704 1.7 D 04:21 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 309150 308944 customc 115656 3.4 R 04:14 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 309155 309021 customc 115412 2.3 D 04:14 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 309134 308829 customc 114748 3.0 R 04:15 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 309142 307867 customc 114404 2.7 R 04:14 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 309046 308835 customc 113716 3.5 D 04:19 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 308916 308276 customc 113392 2.8 R 04:25 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 308866 308833 customc 113388 2.4 R 04:27 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 308977 308655 customc 112924 1.7 R 04:22 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 308953 308173 customc 112508 2.9 R 04:23 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 309097 308562 customc 112004 2.9 R 04:16 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 308935 308924 customc 109932 1.5 D 04:24 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 309062 308632 customc 109168 2.5 R 04:18 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 309037 308626 customc 108188 3.2 R 04:19 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 309044 308236 customc 106080 3.3 R 04:19 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 308928 308201 customc 102016 3.5 R 04:24 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 308918 308627 customc 100372 1.6 D 04:25 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 508924 1 netdata 99616 2.0 Ssl 5-18:01:37 /usr/sbin/netdata -P /run/netdata/netdata.pid -D 308946 308926 customc 99304 2.3 R 04:23 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 309135 308831 customc 97272 3.4 R 04:15 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 309201 309075 customc 95428 2.8 R 04:09 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 308869 308836 customc 94580 3.1 R 04:27 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 308880 308275 customc 93876 4.2 R 04:26 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 308917 292089 customc 92708 4.0 D 04:25 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 308855 308663 customc 91040 2.7 R 04:29 /opt/cpanel/ea-php81/root/usr/bin/php-cgi 308875 308874 customc 90684 4.1 D 04:26 /opt/cpanel/ea-php81/root/usr/bin/php-cgi --- processes in D state (uninterruptible IO) --- 308619 D - /usr/sbin/httpd -k start 308726 D - /opt/cpanel/ea-php81/root/usr/bin/php-cgi 308826 D - /opt/cpanel/ea-php81/root/usr/bin/php-cgi 308851 D - /opt/cpanel/ea-php81/root/usr/bin/php-cgi 308855 D - /opt/cpanel/ea-php81/root/usr/bin/php-cgi 308857 D - /opt/cpanel/ea-php81/root/usr/bin/php-cgi 308860 D - /opt/cpanel/ea-php81/root/usr/bin/php-cgi 308861 D - /opt/cpanel/ea-php81/root/usr/bin/php-cgi 308862 D - /opt/cpanel/ea-php81/root/usr/bin/php-cgi 308864 D - /opt/cpanel/ea-php81/root/usr/bin/php-cgi 308866 D - /opt/cpanel/ea-php81/root/usr/bin/php-cgi 308869 D - /opt/cpanel/ea-php81/root/usr/bin/php-cgi 308875 D - /opt/cpanel/ea-php81/root/usr/bin/php-cgi 308880 D - /opt/cpanel/ea-php81/root/usr/bin/php-cgi 308909 D - php-fpm: pool madalice_com_au 308912 D - /opt/cpanel/ea-php81/root/usr/bin/php-cgi 308913 D - /opt/cpanel/ea-php81/root/usr/bin/php-cgi 308916 D - /opt/cpanel/ea-php81/root/usr/bin/php-cgi 308917 D - /opt/cpanel/ea-php81/root/usr/bin/php-cgi 308918 D - /opt/cpanel/ea-php81/root/usr/bin/php-cgi 308921 D - /opt/cpanel/ea-php81/root/usr/bin/php-cgi 308930 D - /opt/cpanel/ea-php81/root/usr/bin/php-cgi 308933 D - /opt/cpanel/ea-php81/root/usr/bin/php-cgi 308934 D - /opt/cpanel/ea-php81/root/usr/bin/php-cgi 308935 D - /opt/cpanel/ea-php81/root/usr/bin/php-cgi 308945 D - /opt/cpanel/ea-php81/root/usr/bin/php-cgi 308977 D - /opt/cpanel/ea-php81/root/usr/bin/php-cgi 308999 D - /opt/cpanel/ea-php81/root/usr/bin/php-cgi 309003 D - /opt/cpanel/ea-php81/root/usr/bin/php-cgi 309005 D - /opt/cpanel/ea-php81/root/usr/bin/php-cgi --- mariadb processlist (non-sleeping) --- +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | ID | USER | DB | COMMAND | TIME | STATE | q | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ | 1124954 | root | NULL | Query | 0 | Filling schema table | SELECT ID,USER,DB,COMMAND,TIME,STATE,LEFT(INFO,300) q FROM information_schema.PROCESSLIST WHERE COMMAND<>'Sleep' ORDER BY TIME DESC LIMIT 40 | +---------+------+------+---------+------+----------------------+------------------------------------------------------------------------------------------------------------------------------------------------------------+ --- lock waits --- --- vhost traffic RIGHT NOW (last 3 min, deduped by inode) --- VHOST LOG REQ/3min madalice/madalice.com.au-ssl_log 3 (total vhosts taking traffic: 1) --- top client IPs across all vhosts (last 3 min) --- 1 98.82.63.147 1 44.212.232.231 1 35.169.119.108 1 34.238.45.183 1 3.212.205.90 1 23.21.179.27 1 110.249.201.238 --- top request paths across all vhosts (last 3 min) --- 1 GET /wp-content/plugins/elementor/includes/ 1 GET /wp-content/plugins/elementor/data/base/ 1 GET /wp-content/plugins/elementor/assets/js/packages/site-builder/ 1 GET /wp-content/plugins/elementor/assets/js/packages/menus/ 1 GET /wp-content/plugins/elementor/assets/js/packages/env/ 1 GET /wp-content/plugins/elementor/assets/js/packages/editor-styles-repository/ 1 GET /robots.txt --- busiest 3 vhosts: top paths + last 10 requests --- == madalice/madalice.com.au-ssl_log == -- top paths -- 1 GET /wp-content/plugins/elementor/includes/ 1 GET /wp-content/plugins/elementor/data/base/ 1 GET /wp-content/plugins/elementor/assets/js/packages/site-builder/ 1 GET /wp-content/plugins/elementor/assets/js/packages/menus/ 1 GET /wp-content/plugins/elementor/assets/js/packages/env/ 1 GET /wp-content/plugins/elementor/assets/js/packages/editor-styles-repository/ 1 GET /robots.txt -- last 10 requests -- 110.249.201.238 - - [02/Sep/2026:20:20:25 +1000] "GET /robots.txt HTTP/1.1" 304 - "-" "Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; https://zhanzha 98.82.63.147 - - [02/Sep/2026:20:20:29 +1000] "GET /wp-content/plugins/elementor/assets/js/packages/site-builder/?C=S;O%3DA HTTP/1.1" 200 366 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Amazonbot/ 34.238.45.183 - - [02/Sep/2026:20:21:16 +1000] "GET /wp-content/plugins/elementor/assets/js/packages/editor-styles-repository/?C=S;O%3DA HTTP/1.1" 200 367 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatibl 44.212.232.231 - - [02/Sep/2026:20:21:18 +1000] "GET /wp-content/plugins/elementor/data/base/?C=N;O%3DD HTTP/1.1" 200 377 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Amazonbot/0.1; +https://develo 3.212.205.90 - - [02/Sep/2026:20:21:19 +1000] "GET /wp-content/plugins/elementor/assets/js/packages/env/?C=N;O%3DD HTTP/1.1" 200 363 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Amazonbot/0.1; +htt 23.21.179.27 - - [02/Sep/2026:20:21:20 +1000] "GET /wp-content/plugins/elementor/assets/js/packages/menus/?C=N;O%3DD HTTP/1.1" 200 365 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Amazonbot/0.1; +h 35.169.119.108 - - [02/Sep/2026:20:21:20 +1000] "GET /wp-content/plugins/elementor/includes/?C=S;O%3DD HTTP/1.1" 200 754 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Amazonbot/0.1; +https://develop --- last 30 samples (run-up to this incident) --- 2026-09-02 20:14:49 L1=1.08 run=1 blk=0 avail=9381 (68.1%) swpO=0 conn=3 myRSS=2207 php=5 phpRSS=322 ap=19 tcp=30 topuser=madalice 2026-09-02 20:14:59 L1=1.00 run=7 blk=0 avail=9091 (66.0%) swpO=0 conn=1 myRSS=2207 php=8 phpRSS=715 ap=18 tcp=24 topuser=madalice 2026-09-02 20:14:59 L1=1.00 run=3 blk=0 avail=9174 (66.6%) swpO=0 conn=3 myRSS=2207 php=7 phpRSS=603 ap=18 tcp=22 topuser=madalice 2026-09-02 20:15:09 L1=1.15 run=2 blk=0 avail=9320 (67.6%) swpO=0 conn=1 myRSS=2207 php=6 phpRSS=427 ap=17 tcp=25 topuser=madalice 2026-09-02 20:15:09 L1=1.15 run=2 blk=0 avail=9319 (67.6%) swpO=0 conn=3 myRSS=2207 php=7 phpRSS=453 ap=17 tcp=25 topuser=madalice 2026-09-02 20:15:19 L1=1.05 run=1 blk=0 avail=9331 (67.7%) swpO=0 conn=1 myRSS=2207 php=6 phpRSS=427 ap=17 tcp=24 topuser=madalice 2026-09-02 20:15:19 L1=1.05 run=1 blk=0 avail=9328 (67.7%) swpO=0 conn=3 myRSS=2207 php=6 phpRSS=427 ap=17 tcp=24 topuser=madalice 2026-09-02 20:15:29 L1=0.89 run=1 blk=0 avail=9381 (68.1%) swpO=0 conn=1 myRSS=2207 php=5 phpRSS=358 ap=15 tcp=21 topuser=madalice 2026-09-02 20:15:29 L1=0.89 run=1 blk=0 avail=9380 (68.1%) swpO=0 conn=3 myRSS=2207 php=5 phpRSS=358 ap=15 tcp=21 topuser=madalice 2026-09-02 20:15:39 L1=0.75 run=1 blk=0 avail=9517 (69.1%) swpO=0 conn=2 myRSS=2207 php=4 phpRSS=198 ap=14 tcp=22 topuser=madalice 2026-09-02 20:15:39 L1=0.75 run=1 blk=0 avail=9516 (69.1%) swpO=0 conn=2 myRSS=2207 php=4 phpRSS=198 ap=14 tcp=22 topuser=madalice 2026-09-02 20:15:49 L1=0.63 run=2 blk=0 avail=9420 (68.4%) swpO=0 conn=2 myRSS=2207 php=5 phpRSS=283 ap=21 tcp=27 topuser=madalice 2026-09-02 20:15:49 L1=0.63 run=3 blk=1 avail=9361 (67.9%) swpO=0 conn=2 myRSS=2207 php=5 phpRSS=327 ap=21 tcp=28 topuser=madalice 2026-09-02 20:15:59 L1=0.54 run=1 blk=0 avail=9486 (68.9%) swpO=0 conn=2 myRSS=2207 php=4 phpRSS=198 ap=19 tcp=24 topuser=madalice 2026-09-02 20:15:59 L1=0.54 run=1 blk=0 avail=9486 (68.9%) swpO=0 conn=2 myRSS=2207 php=4 phpRSS=198 ap=19 tcp=24 topuser=madalice 2026-09-02 20:16:09 L1=0.45 run=1 blk=0 avail=9501 (69.0%) swpO=0 conn=2 myRSS=2207 php=4 phpRSS=198 ap=16 tcp=24 topuser=madalice 2026-09-02 20:16:09 L1=0.45 run=1 blk=0 avail=9501 (69.0%) swpO=0 conn=2 myRSS=2207 php=4 phpRSS=198 ap=16 tcp=24 topuser=madalice 2026-09-02 20:16:19 L1=0.38 run=1 blk=0 avail=9501 (69.0%) swpO=0 conn=2 myRSS=2207 php=4 phpRSS=198 ap=16 tcp=24 topuser=madalice 2026-09-02 20:16:19 L1=0.38 run=1 blk=0 avail=9499 (69.0%) swpO=0 conn=2 myRSS=2207 php=4 phpRSS=198 ap=16 tcp=24 topuser=madalice 2026-09-02 20:16:29 L1=4.61 run=35 blk=0 avail=6770 (49.1%) swpO=6 conn=27 myRSS=2207 php=33 phpRSS=3416 ap=46 tcp=290 topuser=customc 2026-09-02 20:16:29 L1=4.61 run=37 blk=0 avail=6737 (48.9%) swpO=6 conn=28 myRSS=2207 php=33 phpRSS=3502 ap=47 tcp=290 topuser=customc 2026-09-02 20:16:40 L1=12.10 run=64 blk=0 avail=4489 (32.6%) swpO=2283 conn=46 myRSS=2207 php=52 phpRSS=6022 ap=76 tcp=287 topuser=customc 2026-09-02 20:16:43 L1=15.53 run=78 blk=0 avail=4209 (30.6%) swpO=1793 conn=69 myRSS=2207 php=75 phpRSS=7000 ap=76 tcp=288 topuser=customc 2026-09-02 20:16:50 L1=20.86 run=91 blk=0 avail=2275 (16.5%) swpO=3894 conn=67 myRSS=2209 php=78 phpRSS=9103 ap=96 tcp=289 topuser=customc 2026-09-02 20:16:54 L1=27.68 run=94 blk=0 avail=2143 (15.6%) swpO=3540 conn=78 myRSS=2209 php=91 phpRSS=9532 ap=105 tcp=288 topuser=customc 2026-09-02 20:17:01 L1=34.35 run=107 blk=2 avail=899 (6.5%) swpO=4581 conn=89 myRSS=2200 php=97 phpRSS=10966 ap=126 tcp=293 topuser=customc 2026-09-02 20:17:05 L1=37.52 run=52 blk=61 avail=302 (2.2%) swpO=29580 conn=91 myRSS=1924 php=99 phpRSS=11930 ap=126 tcp=292 topuser=customc 2026-09-02 20:17:13 L1=44.21 run=146 blk=4 avail=117 (0.9%) swpO=54241 conn=- myRSS=1613 php=120 phpRSS=10274 ap=136 tcp=39 topuser=customc 2026-09-02 20:17:50 L1=103.52 run=177 blk=9 avail=137 (1.0%) swpO=11504 conn=91 myRSS=1613 php=123 phpRSS=10364 ap=135 tcp=38 topuser=customc 2026-09-02 20:21:05 L1=190.14 run=4 blk=98 avail=899 (6.5%) swpO=552 conn=86 myRSS=1530 php=117 phpRSS=9622 ap=144 tcp=176 topuser=customc