The gateway did not receive a timely response from the upstream server or application.
Wordpress
it`s just rises the load till gets stucked all the 8 procesor go to 100% load and wen i open the website page i get the message gataway timeout … I try few fix that i find in search but none work for me if i stop the php8.2-fpm that i use from panel the load go to normal 0…
Have you checked the related weblog? Maybe that specific wordpress instance got hacked, are there also other websites on that server? If yes, suspend that specific domain or user and see if it runs properly. If yes, proceed with maldet or similar tools to scan the files for any abnormal content.
No i only have 1 domain on that server, only wen i start php it`s starts the load, if i stop the php no problem
Well you need to find out what web requests are causing the PHP processes. Check the web log as Raphael suggested.
I started with scan first “496149 files scanned” will take some time
This are from error logs (i removed the full domain not to make ad)
[Sat Nov 23 14:40:03.680365 2024] [proxy_fcgi:error] [pid 222811:tid 222863] [client 112.86.225.232:0] AH01079: failed to make connection to backend: localhost
[Sat Nov 23 14:40:04.373074 2024] [proxy:error] [pid 222812:tid 222846] (2)No such file or directory: AH02454: FCGI: attempt to connect to Unix domain socket /run/php/php8.2-fpm-xx-android.com.sock (localhost:8000) failed
[Sat Nov 23 14:40:04.375073 2024] [proxy_fcgi:error] [pid 222812:tid 222846] [client 217.113.194.8:0] AH01079: failed to make connection to backend: localhost
[Sat Nov 23 14:40:05.548939 2024] [proxy:error] [pid 222812:tid 222852] (2)No such file or directory: AH02454: FCGI: attempt to connect to Unix domain socket /run/php/php8.2-fpm-xx-android.com.sock (localhost:8000) failed
[Sat Nov 23 14:40:05.549000 2024] [proxy_fcgi:error] [pid 222812:tid 222852] [client 116.179.32.96:0] AH01079: failed to make connection to backend: localhost
[Sat Nov 23 14:40:09.152702 2024] [proxy:error] [pid 222811:tid 222867] (2)No such file or directory: AH02454: FCGI: attempt to connect to Unix domain socket /run/php/php8.2-fpm-xx-android.com.sock (localhost:8000) failed
[Sat Nov 23 14:40:09.152753 2024] [proxy_fcgi:error] [pid 222811:tid 222867] [client 17.241.219.171:0] AH01079: failed to make connection to backend: localhost
[Sat Nov 23 14:40:14.433638 2024] [proxy:error] [pid 222811:tid 222842] (2)No such file or directory: AH02454: FCGI: attempt to connect to Unix domain socket /run/php/php8.2-fpm-xx-android.com.sock (localhost:8000) failed
[Sat Nov 23 14:40:14.433692 2024] [proxy_fcgi:error] [pid 222811:tid 222842] [client 217.113.194.6:0] AH01079: failed to make connection to backend: localhost
Check the web log, to see what requests are hitting the site. The issue is resource usage from PHP processes, so you need to see what’s causing that
The error log will show the symptoms (connection timeouts) but it won’t show you the cause (what’s visiting your site)
Here i think is the problem (error log)
[Sat Nov 23 14:40:09.152702 2024] [proxy:error] [pid 222811:tid 222867] (2)No such file or directory: AH02454: FCGI: attempt to connect to Unix domain socket /run/php/php8.2-fpm-xx-android.com.sock (localhost:8000) failed
[Sat Nov 23 14:40:09.152753 2024] [proxy_fcgi:error] [pid 222811:tid 222867] [client 17.241.219.171:0] AH01079: failed to make connection to backend: localhost
[Sat Nov 23 14:40:14.433638 2024] [proxy:error] [pid 222811:tid 222842] (2)No such file or directory: AH02454: FCGI: attempt to connect to Unix domain socket /run/php/php8.2-fpm-xx-android.com.sock (localhost:8000) failed
[Sat Nov 23 14:40:14.433692 2024] [proxy_fcgi:error] [pid 222811:tid 222842] [client 217.113.194.6:0] AH01079: failed to make connection to backend: localhost
Traffic log is ok, just checked last 1000 lines, normal traffic (i have a wordpress website sincer 2012)
i wait maldet to scan all the files 147890/496149 nothing till now
What about ‘ps axu’
To know what is running.
Or maybe ‘top’
Check the normal traffic from bots.
Maldet is no warranty of being clean.
Since it is. Wordpress install you may download and update everything.
Just clear all PHP files and reinstall from the source.
I will wait for maldet to finish and i will install all the vps and hcp from the ground
maldet(295315): {scan} 354316/496149 files scanned: 0 hits 0 cleaned
netstat and ps
netstat -pan
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 127.0.0.1:9000 0.0.0.0:* LISTEN 1930738/php-fpm: ma
tcp 0 0 213.136.xx.xx:8443 0.0.0.0:* LISTEN 133164/apache2
tcp 0 0 0.0.0.0:587 0.0.0.0:* LISTEN 1957/exim4
tcp 0 0 0.0.0.0:993 0.0.0.0:* LISTEN 1672/dovecot
tcp 0 0 0.0.0.0:995 0.0.0.0:* LISTEN 1672/dovecot
tcp 0 0 0.0.0.0:143 0.0.0.0:* LISTEN 1672/dovecot
tcp 0 0 0.0.0.0:25 0.0.0.0:* LISTEN 1957/exim4
tcp 0 0 0.0.0.0:21 0.0.0.0:* LISTEN 567/vsftpd
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN 16093/sshd: /usr/sb
tcp 0 0 0.0.0.0:110 0.0.0.0:* LISTEN 1672/dovecot
tcp 0 0 0.0.0.0:465 0.0.0.0:* LISTEN 1957/exim4
tcp 0 0 213.136.xx.xx:8080 0.0.0.0:* LISTEN 133164/apache2
tcp 0 0 127.0.0.1:8081 0.0.0.0:* LISTEN 133164/apache2
tcp 0 0 127.0.0.1:8084 0.0.0.0:* LISTEN 132362/nginx: maste
tcp 0 0 127.0.0.53:53 0.0.0.0:* LISTEN 545/systemd-resolve
tcp 0 0 127.0.0.1:953 0.0.0.0:* LISTEN 12561/named
tcp 0 0 127.0.0.1:953 0.0.0.0:* LISTEN 12561/named
tcp 0 0 127.0.0.1:953 0.0.0.0:* LISTEN 12561/named
tcp 0 0 127.0.0.1:953 0.0.0.0:* LISTEN 12561/named
tcp 0 0 127.0.0.1:953 0.0.0.0:* LISTEN 12561/named
tcp 0 0 127.0.0.1:953 0.0.0.0:* LISTEN 12561/named
tcp 0 0 127.0.0.1:953 0.0.0.0:* LISTEN 12561/named
tcp 0 0 127.0.0.1:953 0.0.0.0:* LISTEN 12561/named
tcp 0 0 127.0.0.1:53 0.0.0.0:* LISTEN 12561/named
tcp 0 0 127.0.0.1:53 0.0.0.0:* LISTEN 12561/named
tcp 0 0 127.0.0.1:53 0.0.0.0:* LISTEN 12561/named
tcp 0 0 127.0.0.1:53 0.0.0.0:* LISTEN 12561/named
tcp 0 0 127.0.0.1:53 0.0.0.0:* LISTEN 12561/named
tcp 0 0 127.0.0.1:53 0.0.0.0:* LISTEN 12561/named
tcp 0 0 127.0.0.1:53 0.0.0.0:* LISTEN 12561/named
tcp 0 0 127.0.0.1:53 0.0.0.0:* LISTEN 12561/named
tcp 0 0 0.0.0.0:5758 0.0.0.0:* LISTEN 1845/nginx: master
tcp 0 0 213.136.xx.xx:53 0.0.0.0:* LISTEN 12561/named
tcp 0 0 213.136.xx.xx:53 0.0.0.0:* LISTEN 12561/named
tcp 0 0 213.136.xx.xx:53 0.0.0.0:* LISTEN 12561/named
tcp 0 0 213.136.xx.xx:53 0.0.0.0:* LISTEN 12561/named
tcp 0 0 213.136.xx.xx:53 0.0.0.0:* LISTEN 12561/named
tcp 0 0 213.136.xx.xx:53 0.0.0.0:* LISTEN 12561/named
tcp 0 0 213.136.xx.xx:53 0.0.0.0:* LISTEN 12561/named
tcp 0 0 213.136.xx.xx:53 0.0.0.0:* LISTEN 12561/named
tcp 0 0 213.136.xx.xx:80 0.0.0.0:* LISTEN 132362/nginx: maste
tcp 0 0 213.136.xx.xx:443 0.0.0.0:* LISTEN 132362/nginx: maste
tcp 0 0 127.0.0.1:3306 0.0.0.0:* LISTEN 54854/mariadbd
tcp 25 0 213.136.xx.xx:8443 213.136.xx.xx:42444 CLOSE_WAIT 1331475/apache2
tcp 0 0 213.136.xx.xx:22 84.xx.xx.xx:58175 ESTABLISHED 292951/sshd: root@p
tcp 25 0 213.136.xx.xx:8443 213.136.xx.xx:42520 CLOSE_WAIT 1331475/apache2
tcp 25 0 213.136.xx.xx:8443 213.136.xx.xx:42488 CLOSE_WAIT 1331474/apache2
tcp 25 0 213.136.xx.xx:8443 213.136.xx.xx:42502 CLOSE_WAIT 1331475/apache2
tcp 25 0 213.136.xx.xx:8443 213.136.xx.xx:42442 CLOSE_WAIT 1331474/apache2
tcp 0 0 213.136.xx.xx:443 47.128.49.132:36686 ESTABLISHED 1332069/nginx: work
tcp 0 0 213.136.xx.xx:42538 213.136.xx.xx:8443 ESTABLISHED 1332069/nginx: work
tcp 25 0 213.136.xx.xx:8443 213.136.xx.xx:42438 CLOSE_WAIT 1331474/apache2
tcp 0 0 213.136.xx.xx:443 57.141.0.28:55994 ESTABLISHED 1332069/nginx: work
tcp 25 0 213.136.xx.xx:8443 213.136.xx.xx:42464 CLOSE_WAIT 1331475/apache2
tcp 0 0 213.136.xx.xx:42526 213.136.xx.xx:8443 FIN_WAIT2 -
tcp 25 0 213.136.xx.xx:8443 213.136.xx.xx:42466 CLOSE_WAIT 1331475/apache2
tcp 25 0 213.136.xx.xx:8443 213.136.xx.xx:42472 CLOSE_WAIT 1331475/apache2
tcp 25 0 213.136.xx.xx:8443 213.136.xx.xx:42456 CLOSE_WAIT 1331474/apache2
tcp 25 0 213.136.xx.xx:8443 213.136.xx.xx:42506 CLOSE_WAIT 1331474/apache2
tcp 25 0 213.136.xx.xx:8443 213.136.xx.xx:42510 CLOSE_WAIT 1331475/apache2
tcp 25 0 213.136.xx.xx:8443 213.136.xx.xx:42534 CLOSE_WAIT 1331475/apache2
tcp 25 0 213.136.xx.xx:8443 213.136.xx.xx:42482 CLOSE_WAIT 1331474/apache2
tcp 0 0 213.136.xx.xx:8443 213.136.xx.xx:42512 ESTABLISHED 1331474/apache2
tcp 25 0 213.136.xx.xx:8443 213.136.xx.xx:42496 CLOSE_WAIT 1331474/apache2
tcp 25 0 213.136.xx.xx:8443 213.136.xx.xx:42460 CLOSE_WAIT 1331475/apache2
tcp 0 7136 213.136.xx.xx:22 84.xx.xx.xx:58335 ESTABLISHED 338646/sshd: root@p
tcp 25 0 213.136.xx.xx:8443 213.136.xx.xx:42494 CLOSE_WAIT 1331474/apache2
tcp 0 0 213.136.xx.xx:443 116.179.32.215:28959 ESTABLISHED 1332069/nginx: work
tcp 25 0 213.136.xx.xx:8443 213.136.xx.xx:42450 CLOSE_WAIT 1331475/apache2
tcp 25 0 213.136.xx.xx:8443 213.136.xx.xx:42498 CLOSE_WAIT 1331474/apache2
tcp 25 0 213.136.xx.xx:8443 213.136.xx.xx:42454 CLOSE_WAIT 1331474/apache2
tcp 0 0 213.136.xx.xx:42520 213.136.xx.xx:8443 FIN_WAIT2 -
tcp 25 0 213.136.xx.xx:8443 213.136.xx.xx:42486 CLOSE_WAIT 1331474/apache2
tcp 0 0 213.136.xx.xx:443 66.249.66.68:62586 ESTABLISHED 1332069/nginx: work
tcp 0 0 213.136.xx.xx:42512 213.136.xx.xx:8443 ESTABLISHED 1332069/nginx: work
tcp 0 0 213.136.xx.xx:42434 213.136.xx.xx:8443 ESTABLISHED 1332069/nginx: work
tcp 0 0 213.136.xx.xx:42530 213.136.xx.xx:8443 FIN_WAIT2 -
tcp 25 0 213.136.xx.xx:8443 213.136.xx.xx:42446 CLOSE_WAIT 1331474/apache2
tcp 0 0 213.136.xx.xx:8443 213.136.xx.xx:42528 ESTABLISHED 1331475/apache2
tcp 25 0 213.136.xx.xx:8443 213.136.xx.xx:42458 CLOSE_WAIT 1331475/apache2
tcp 25 0 213.136.xx.xx:8443 213.136.xx.xx:42526 CLOSE_WAIT 1331474/apache2
tcp 25 0 213.136.xx.xx:8443 213.136.xx.xx:42462 CLOSE_WAIT 1331475/apache2
tcp 25 0 213.136.xx.xx:8443 213.136.xx.xx:42500 CLOSE_WAIT 1943883/apache2
tcp 0 0 213.136.xx.xx:443 220.181.108.176:19291 ESTABLISHED 1332069/nginx: work
tcp 0 0 213.136.xx.xx:42532 213.136.xx.xx:8443 FIN_WAIT2 -
tcp 25 0 213.136.xx.xx:8443 213.136.xx.xx:42518 CLOSE_WAIT 1331474/apache2
tcp 25 0 213.136.xx.xx:8443 213.136.xx.xx:42468 CLOSE_WAIT 1331475/apache2
tcp 0 0 213.136.xx.xx:8443 213.136.xx.xx:42434 ESTABLISHED 1331475/apache2
tcp 25 0 213.136.xx.xx:8443 213.136.xx.xx:42484 CLOSE_WAIT 1331475/apache2
tcp 25 0 213.136.xx.xx:8443 213.136.xx.xx:42530 CLOSE_WAIT 1331474/apache2
tcp 0 0 213.136.xx.xx:8443 213.136.xx.xx:42538 ESTABLISHED 1331474/apache2
tcp 25 0 213.136.xx.xx:8443 213.136.xx.xx:42524 CLOSE_WAIT 1331474/apache2
tcp 0 0 213.136.xx.xx:42528 213.136.xx.xx:8443 ESTABLISHED 1332069/nginx: work
tcp 25 0 213.136.xx.xx:8443 213.136.xx.xx:42436 CLOSE_WAIT 1331475/apache2
tcp 25 0 213.136.xx.xx:8443 213.136.xx.xx:42470 CLOSE_WAIT 1331475/apache2
tcp 25 0 213.136.xx.xx:8443 213.136.xx.xx:42478 CLOSE_WAIT 1331474/apache2
tcp 25 0 213.136.xx.xx:8443 213.136.xx.xx:42452 CLOSE_WAIT 1331475/apache2
tcp 0 0 213.136.xx.xx:8443 213.136.xx.xx:42514 ESTABLISHED 1331474/apache2
tcp 0 0 213.136.xx.xx:42534 213.136.xx.xx:8443 FIN_WAIT2 -
tcp 25 0 213.136.xx.xx:8443 213.136.xx.xx:42522 CLOSE_WAIT 1331474/apache2
tcp 25 0 213.136.xx.xx:8443 213.136.xx.xx:42532 CLOSE_WAIT 1331474/apache2
tcp 0 0 213.136.xx.xx:42514 213.136.xx.xx:8443 ESTABLISHED 1332069/nginx: work
tcp6 0 0 ::1:953 :::* LISTEN 12561/named
tcp6 0 0 ::1:953 :::* LISTEN 12561/named
tcp6 0 0 ::1:953 :::* LISTEN 12561/named
tcp6 0 0 ::1:953 :::* LISTEN 12561/named
tcp6 0 0 ::1:953 :::* LISTEN 12561/named
tcp6 0 0 ::1:953 :::* LISTEN 12561/named
tcp6 0 0 ::1:953 :::* LISTEN 12561/named
tcp6 0 0 ::1:953 :::* LISTEN 12561/named
tcp6 0 0 :::993 :::* LISTEN 1672/dovecot
tcp6 0 0 :::995 :::* LISTEN 1672/dovecot
tcp6 0 0 :::143 :::* LISTEN 1672/dovecot
tcp6 0 0 :::22 :::* LISTEN 16093/sshd: /usr/sb
tcp6 0 0 :::110 :::* LISTEN 1672/dovecot
tcp6 0 0 fe80::250:xxxx:xxxx::53 :::* LISTEN 12561/named
tcp6 0 0 fe80::250:xxxx:xxxx::53 :::* LISTEN 12561/named
tcp6 0 0 fe80::250:xxxx:xxxx::53 :::* LISTEN 12561/named
tcp6 0 0 fe80::250:xxxx:xxxx::53 :::* LISTEN 12561/named
tcp6 0 0 fe80::250:xxxx:xxxx::53 :::* LISTEN 12561/named
tcp6 0 0 fe80::250:xxxx:xxxx::53 :::* LISTEN 12561/named
tcp6 0 0 fe80::250:xxxx:xxxx::53 :::* LISTEN 12561/named
tcp6 0 0 fe80::250:xxxx:xxxx::53 :::* LISTEN 12561/named
udp 0 0 127.0.0.1:55046 127.0.0.53:53 ESTABLISHED 1332081/nginx: work
udp 0 0 127.0.0.1:55891 127.0.0.53:53 ESTABLISHED 1332070/nginx: work
udp 0 0 127.0.0.1:57576 127.0.0.53:53 ESTABLISHED 1332069/nginx: work
udp 0 0 127.0.0.1:58227 127.0.0.53:53 ESTABLISHED 1332071/nginx: work
udp 0 0 127.0.0.1:45625 127.0.0.53:53 ESTABLISHED 1332075/nginx: work
udp 0 0 127.0.0.1:47590 127.0.0.53:53 ESTABLISHED 1332077/nginx: work
udp 0 0 213.136.xx.xx:53 0.0.0.0:* 12561/named
udp 0 0 213.136.xx.xx:53 0.0.0.0:* 12561/named
udp 0 0 213.136.xx.xx:53 0.0.0.0:* 12561/named
udp 0 0 213.136.xx.xx:53 0.0.0.0:* 12561/named
udp 0 0 213.136.xx.xx:53 0.0.0.0:* 12561/named
udp 0 0 213.136.xx.xx:53 0.0.0.0:* 12561/named
udp 0 0 213.136.xx.xx:53 0.0.0.0:* 12561/named
udp 0 0 213.136.xx.xx:53 0.0.0.0:* 12561/named
udp 0 0 127.0.0.1:53 0.0.0.0:* 12561/named
udp 0 0 127.0.0.1:53 0.0.0.0:* 12561/named
udp 0 0 127.0.0.1:53 0.0.0.0:* 12561/named
udp 0 0 127.0.0.1:53 0.0.0.0:* 12561/named
udp 0 0 127.0.0.1:53 0.0.0.0:* 12561/named
udp 0 0 127.0.0.1:53 0.0.0.0:* 12561/named
udp 0 0 127.0.0.1:53 0.0.0.0:* 12561/named
udp 0 0 127.0.0.1:53 0.0.0.0:* 12561/named
udp 0 0 127.0.0.53:53 0.0.0.0:* 545/systemd-resolve
udp 0 0 127.0.0.1:53732 127.0.0.53:53 ESTABLISHED 1332068/nginx: work
udp6 0 0 fe80::250:xxxx:xxxx::53 :::* 12561/named
udp6 0 0 fe80::250:xxxx:xxxx::53 :::* 12561/named
udp6 0 0 fe80::250:xxxx:xxxx::53 :::* 12561/named
udp6 0 0 fe80::250:xxxx:xxxx::53 :::* 12561/named
udp6 0 0 fe80::250:xxxx:xxxx::53 :::* 12561/named
udp6 0 0 fe80::250:xxxx:xxxx::53 :::* 12561/named
udp6 0 0 fe80::250:xxxx:xxxx::53 :::* 12561/named
udp6 0 0 fe80::250:xxxx:xxxx::53 :::* 12561/named
raw6 0 0 :::58 :::* 7 536/systemd-network
Active UNIX domain sockets (servers and established)```Active UNIX domain sockets (servers and established)
Proto RefCnt Flags Type State I-Node PID/Program name Path
unix 2 [ ACC ] STREAM LISTENING 20094 1958/php-fpm: maste /run/hestia-php.sock
unix 2 [ ] DGRAM 1043412 292954/systemd /run/user/0/systemd/notify
unix 2 [ ACC ] STREAM LISTENING 1043415 292954/systemd /run/user/0/systemd/private
unix 2 [ ACC ] STREAM LISTENING 1046217 292954/systemd /run/user/0/gnupg/S.dirmngr
unix 2 [ ACC ] STREAM LISTENING 1046219 292954/systemd /run/user/0/gnupg/S.gpg-agent.browser
unix 2 [ ACC ] STREAM LISTENING 1046221 292954/systemd /run/user/0/gnupg/S.gpg-agent.extra
unix 2 [ ACC ] STREAM LISTENING 1046223 292954/systemd /run/user/0/gnupg/S.gpg-agent.ssh
unix 2 [ ACC ] STREAM LISTENING 1046225 292954/systemd /run/user/0/gnupg/S.gpg-agent
unix 2 [ ACC ] STREAM LISTENING 1046227 292954/systemd /run/user/0/pk-debconf-socket
unix 2 [ ACC ] STREAM LISTENING 18552 1/init /run/acpid.socket
unix 2 [ ACC ] STREAM LISTENING 18554 1/init /run/dbus/system_bus_socket
unix 2 [ ACC ] STREAM LISTENING 18556 1/init /run/uuidd/request
unix 3 [ ] DGRAM CONNECTED 19527 1/init /run/systemd/notify
unix 2 [ ACC ] STREAM LISTENING 19530 1/init /run/systemd/private
unix 2 [ ACC ] STREAM LISTENING 19532 1/init /run/systemd/userdb/io.systemd.DynamicUser
unix 2 [ ACC ] STREAM LISTENING 19533 1/init /run/systemd/io.system.ManagedOOM
unix 2 [ ] DGRAM 19543 1/init /run/systemd/journal/syslog
unix 10 [ ] DGRAM CONNECTED 19550 1/init /run/systemd/journal/dev-log
unix 9 [ ] DGRAM CONNECTED 19552 1/init /run/systemd/journal/socket
unix 2 [ ACC ] STREAM LISTENING 19554 1/init /run/systemd/journal/stdout
unix 2 [ ACC ] SEQPACKET LISTENING 19557 1/init /run/udev/control
unix 2 [ ACC ] STREAM LISTENING 14931 501/irqbalance /run/irqbalance/irqbalance501.sock
unix 2 [ ACC ] STREAM LISTENING 13947 289/systemd-journal /run/systemd/journal/io.systemd.journal
unix 2 [ ] DGRAM 8847759 1957/exim4 @/var/spool/exim4/exim_daemon_notify
unix 2 [ ACC ] STREAM LISTENING 8844255 1672/dovecot /run/dovecot/stats-reader
unix 2 [ ACC ] STREAM LISTENING 8844256 1672/dovecot /run/dovecot/stats-writer
unix 2 [ ACC ] STREAM LISTENING 8844257 1672/dovecot /run/dovecot/replicator
unix 2 [ ACC ] STREAM LISTENING 8844258 1672/dovecot /run/dovecot/replication-notify
unix 2 [ ACC ] STREAM LISTENING 8844259 1672/dovecot /run/dovecot/login/pop3
unix 2 [ ACC ] STREAM LISTENING 8844260 1672/dovecot /run/dovecot/old-stats
unix 2 [ ACC ] STREAM LISTENING 8844261 1672/dovecot /run/dovecot/log-errors
unix 2 [ ACC ] STREAM LISTENING 8844262 1672/dovecot /run/dovecot/ipc
unix 2 [ ACC ] STREAM LISTENING 8844263 1672/dovecot /run/dovecot/login/ipc-proxy
unix 2 [ ACC ] STREAM LISTENING 8844264 1672/dovecot /run/dovecot/indexer-worker
unix 2 [ ACC ] STREAM LISTENING 8844265 1672/dovecot /run/dovecot/indexer
unix 2 [ ACC ] STREAM LISTENING 8844266 1672/dovecot /run/dovecot/login/imap
unix 2 [ ACC ] STREAM LISTENING 18640 545/systemd-resolve /run/systemd/resolve/io.systemd.Resolve
unix 2 [ ACC ] STREAM LISTENING 8844267 1672/dovecot /run/dovecot/imap-master
unix 2 [ ACC ] STREAM LISTENING 8844268 1672/dovecot /run/dovecot/imap-urlauth-worker
unix 2 [ ACC ] STREAM LISTENING 8844269 1672/dovecot /run/dovecot/token-login/imap-urlauth
unix 2 [ ACC ] STREAM LISTENING 8844270 1672/dovecot /run/dovecot/imap-urlauth
unix 2 [ ACC ] STREAM LISTENING 8844271 1672/dovecot /run/dovecot/imap-hibernate
unix 2 [ ACC ] STREAM LISTENING 8844272 1672/dovecot /run/dovecot/doveadm-server
unix 2 [ ACC ] STREAM LISTENING 8844273 1672/dovecot /run/dovecot/dns-client
unix 2 [ ACC ] STREAM LISTENING 8844274 1672/dovecot /run/dovecot/login/dns-client
unix 2 [ ACC ] STREAM LISTENING 8844275 1672/dovecot /run/dovecot/director-admin
unix 2 [ ACC ] STREAM LISTENING 8844276 1672/dovecot /run/dovecot/director-userdb
unix 2 [ ACC ] STREAM LISTENING 8844277 1672/dovecot /run/dovecot/dict
unix 2 [ ACC ] STREAM LISTENING 8844278 1672/dovecot /run/dovecot/dict-async
unix 2 [ ACC ] STREAM LISTENING 8844279 1672/dovecot /run/dovecot/config
unix 2 [ ACC ] STREAM LISTENING 8844280 1672/dovecot /run/dovecot/login/login
unix 2 [ ACC ] STREAM LISTENING 8844281 1672/dovecot /run/dovecot/token-login/tokenlogin
unix 2 [ ACC ] STREAM LISTENING 8844282 1672/dovecot /run/dovecot/auth-login
unix 2 [ ACC ] STREAM LISTENING 8844283 1672/dovecot /run/dovecot/auth-client
unix 2 [ ACC ] STREAM LISTENING 8844284 1672/dovecot /run/dovecot/auth-userdb
unix 2 [ ACC ] STREAM LISTENING 8844285 1672/dovecot /run/dovecot/auth-master
unix 2 [ ACC ] STREAM LISTENING 8844286 1672/dovecot /run/dovecot/auth-worker
unix 2 [ ACC ] STREAM LISTENING 20762 549/python3 /var/run/fail2ban/fail2ban.sock
unix 2 [ ACC ] STREAM LISTENING 9751588 1930738/php-fpm: ma /run/php/php8.2-fpm-xx-android.com.sock
unix 2 [ ACC ] STREAM LISTENING 9751590 1930738/php-fpm: ma /run/php/php8.2-fpm-xx.net.sock
unix 2 [ ACC ] STREAM LISTENING 197519 54854/mariadbd /run/mysqld/mysqld.sock
unix 2 [ ACC ] STREAM LISTENING 23734 1672/dovecot /run/dovecot/anvil
unix 2 [ ACC ] STREAM LISTENING 23735 1672/dovecot /run/dovecot/anvil-auth-penalty
unix 2 [ ACC ] STREAM LISTENING 23736 1672/dovecot /run/dovecot/master
unix 3 [ ] STREAM CONNECTED 8847774 132362/nginx: maste
unix 3 [ ] STREAM CONNECTED 9756083 1331474/apache2
unix 3 [ ] STREAM CONNECTED 9752318 1934448/php-fpm: po /run/php/php8.2-fpm-xx-android.com.sock
unix 3 [ ] STREAM CONNECTED 9779291 1331474/apache2
unix 3 [ ] STREAM CONNECTING 0 - /run/php/php8.2-fpm-xx-android.com.sock
unix 3 [ ] STREAM CONNECTED 20093 1958/php-fpm: maste
unix 3 [ ] DGRAM CONNECTED 21666 326/systemd-udevd
unix 3 [ ] STREAM CONNECTED 9771792 1331474/apache2
unix 3 [ ] STREAM CONNECTED 14939 490/@dbus-daemon /run/dbus/system_bus_socket
unix 3 [ ] STREAM CONNECTING 0 - /run/php/php8.2-fpm-xx-android.com.sock
unix 3 [ ] STREAM CONNECTED 52827 16093/sshd: /usr/sb
unix 3 [ ] STREAM CONNECTED 9776182 1331474/apache2
unix 3 [ ] STREAM CONNECTING 0 - /run/php/php8.2-fpm-xx-android.com.sock
unix 3 [ ] STREAM CONNECTED 18315 545/systemd-resolve
unix 3 [ ] STREAM CONNECTED 8847779 132362/nginx: maste
unix 3 [ ] STREAM CONNECTED 8847772 132362/nginx: maste
unix 2 [ ] DGRAM CONNECTED 1043405 292954/systemd
unix 3 [ ] STREAM CONNECTED 14947 540/polkitd
unix 3 [ ] STREAM CONNECTED 121285 37290/packagekitd
unix 3 [ ] STREAM CONNECTED 21652 326/systemd-udevd
unix 3 [ ] STREAM CONNECTED 9751030 1331475/apache2
unix 3 [ ] STREAM CONNECTED 9779285 1331475/apache2
unix 2 [ ] DGRAM CONNECTED 15835 506/systemd-logind
unix 3 [ ] STREAM CONNECTING 0 - /run/php/php8.2-fpm-xx-android.com.sock
unix 2 [ ] STREAM CONNECTED 1111533 338646/sshd: root@p
unix 3 [ ] DGRAM CONNECTED 18253 472/systemd-timesyn
unix 3 [ ] STREAM CONNECTED 9770997 1331475/apache2
unix 3 [ ] STREAM CONNECTING 0 - /run/php/php8.2-fpm-xx-android.com.sock
unix 3 [ ] STREAM CONNECTED 9771385 1331474/apache2
unix 3 [ ] STREAM CONNECTED 9750457 1933711/php-fpm: po /run/php/php8.2-fpm-xx-android.com.sock
unix 3 [ ] STREAM CONNECTED 1049854 1/init /run/systemd/journal/stdout
unix 3 [ ] STREAM CONNECTING 0 - /run/php/php8.2-fpm-xx-android.com.sock
unix 3 [ ] STREAM CONNECTED 15876 565/python3
unix 3 [ ] DGRAM CONNECTED 21850 536/systemd-network
unix 3 [ ] STREAM CONNECTED 9770919 1331474/apache2
unix 3 [ ] STREAM CONNECTING 0 - /run/php/php8.2-fpm-xx-android.com.sock
unix 3 [ ] DGRAM CONNECTED 18252 472/systemd-timesyn
unix 3 [ ] STREAM CONNECTING 0 - /run/php/php8.2-fpm-xx-android.com.sock
unix 3 [ ] DGRAM CONNECTED 18561 1/init
unix 3 [ ] STREAM CONNECTED 8847768 132362/nginx: maste
unix 2 [ ] DGRAM CONNECTED 1049831 292951/sshd: root@p
unix 3 [ ] DGRAM CONNECTED 1043413 292954/systemd
unix 3 [ ] STREAM CONNECTING 0 - /run/php/php8.2-fpm-xx-android.com.sock
unix 3 [ ] STREAM CONNECTED 18637 545/systemd-resolve
unix 3 [ ] STREAM CONNECTED 21851 536/systemd-network
unix 3 [ ] STREAM CONNECTED 18398 565/python3
unix 3 [ ] STREAM CONNECTED 18325 549/python3
unix 3 [ ] STREAM CONNECTED 14129 506/systemd-logind
unix 3 [ ] STREAM CONNECTED 9755109 1331474/apache2
unix 2 [ ] STREAM CONNECTED 9752354 1934592/php-fpm: po
unix 3 [ ] STREAM CONNECTING 0 - /run/php/php8.2-fpm-xx-android.com.sock
unix 3 [ ] STREAM CONNECTED 119656 490/@dbus-daemon /run/dbus/system_bus_socket
unix 2 [ ] DGRAM CONNECTED 1113707 338646/sshd: root@p
unix 3 [ ] STREAM CONNECTED 8845943 132362/nginx: maste
unix 3 [ ] STREAM CONNECTED 8847775 132362/nginx: maste
unix 3 [ ] STREAM CONNECTING 0 - /run/php/php8.2-fpm-xx-android.com.sock
unix 3 [ ] STREAM CONNECTED 21904 502/python3
unix 3 [ ] STREAM CONNECTED 9765672 1331475/apache2
unix 3 [ ] STREAM CONNECTED 23691 1672/dovecot
unix 3 [ ] STREAM CONNECTED 18299 490/@dbus-daemon
unix 3 [ ] STREAM CONNECTED 9756044 1331475/apache2
unix 3 [ ] STREAM CONNECTED 8847778 132362/nginx: maste
unix 3 [ ] STREAM CONNECTED 9751465 1331474/apache2
unix 3 [ ] STREAM CONNECTED 9751585 1930738/php-fpm: ma
unix 3 [ ] STREAM CONNECTED 22176 1672/dovecot
unix 3 [ ] STREAM CONNECTED 19756 502/python3
unix 3 [ ] STREAM CONNECTED 18573 1/init /run/systemd/journal/stdout
unix 2 [ ] STREAM CONNECTED 9750458 1933711/php-fpm: po
unix 3 [ ] STREAM CONNECTED 19014 1845/nginx: master
unix 3 [ ] DGRAM CONNECTED 21847 536/systemd-network
unix 3 [ ] STREAM CONNECTING 0 - /run/php/php8.2-fpm-xx-android.com.sock
unix 3 [ ] DGRAM CONNECTED 1043414 292954/systemd
unix 2 [ ] DGRAM CONNECTED 1043393 292955/(sd-pam)
unix 3 [ ] STREAM CONNECTED 21875 1/init /run/systemd/journal/stdout
unix 3 [ ] STREAM CONNECTED 18232 472/systemd-timesyn
unix 3 [ ] STREAM CONNECTING 0 - /run/php/php8.2-fpm-xx-android.com.sock
unix 2 [ ] DGRAM CONNECTED 117540 37290/packagekitd
unix 3 [ ] STREAM CONNECTED 9771949 1331474/apache2
unix 3 [ ] STREAM CONNECTED 9771028 1331474/apache2
unix 3 [ ] STREAM CONNECTED 9756818 1933791/php-fpm: po /run/php/php8.2-fpm-xx-android.com.sock
unix 3 [ ] STREAM CONNECTED 9756078 1331475/apache2
unix 3 [ ] STREAM CONNECTED 18301 490/@dbus-daemon /run/dbus/system_bus_socket
unix 3 [ ] STREAM CONNECTED 9765641 1331474/apache2
unix 3 [ ] STREAM CONNECTED 1043417 292954/systemd
unix 3 [ ] STREAM CONNECTED 8847769 132362/nginx: maste
unix 3 [ ] DGRAM CONNECTED 21665 326/systemd-udevd
unix 3 [ ] STREAM CONNECTED 9770896 1331475/apache2
unix 3 [ ] STREAM CONNECTED 9761435 1331475/apache2
unix 3 [ ] STREAM CONNECTING 0 - /run/php/php8.2-fpm-xx-android.com.sock
unix 3 [ ] STREAM CONNECTING 0 - /run/php/php8.2-fpm-xx-android.com.sock
unix 2 [ ] STREAM CONNECTED 9756819 1933791/php-fpm: po
unix 3 [ ] STREAM CONNECTED 21752 488/accounts-daemon
unix 3 [ ] STREAM CONNECTING 0 - /run/php/php8.2-fpm-xx-android.com.sock
unix 3 [ ] STREAM CONNECTED 1044414 490/@dbus-daemon /run/dbus/system_bus_socket
unix 3 [ ] STREAM CONNECTED 8847771 132362/nginx: maste
unix 2 [ ] DGRAM CONNECTED 18631 545/systemd-resolve
unix 3 [ ] STREAM CONNECTED 18302 490/@dbus-daemon /run/dbus/system_bus_socket
unix 3 [ ] STREAM CONNECTED 9752353 1934592/php-fpm: po /run/php/php8.2-fpm-xx-android.com.sock
unix 3 [ ] STREAM CONNECTED 8845940 132362/nginx: maste
unix 3 [ ] STREAM CONNECTING 0 - /run/php/php8.2-fpm-xx-android.com.sock
unix 3 [ ] STREAM CONNECTED 21827 536/systemd-network
unix 3 [ ] DGRAM CONNECTED 18560 1/init
unix 3 [ ] STREAM CONNECTING 0 - /run/php/php8.2-fpm-xx-android.com.sock
unix 3 [ ] STREAM CONNECTED 9768792 1331475/apache2
unix 3 [ ] STREAM CONNECTING 0 - /run/php/php8.2-fpm-xx-android.com.sock
unix 3 [ ] STREAM CONNECTED 9758898 1331475/apache2
unix 3 [ ] STREAM CONNECTED 14932 1/init /run/systemd/journal/stdout
unix 2 [ ] DGRAM CONNECTED 14126 489/cron
unix 3 [ ] STREAM CONNECTED 18399 565/python3
unix 2 [ ] DGRAM CONNECTED 18298 490/@dbus-daemon
unix 3 [ ] STREAM CONNECTED 8847776 132362/nginx: maste
unix 3 [ ] STREAM CONNECTED 9773621 1331474/apache2
unix 3 [ ] STREAM CONNECTING 0 - /run/php/php8.2-fpm-xx-android.com.sock
unix 3 [ ] STREAM CONNECTED 9755325 1331474/apache2
unix 3 [ ] STREAM CONNECTED 14969 490/@dbus-daemon /run/dbus/system_bus_socket
unix 3 [ ] STREAM CONNECTED 19731 490/@dbus-daemon /run/dbus/system_bus_socket
unix 2 [ ] DGRAM CONNECTED 21841 536/systemd-network
unix 3 [ ] STREAM CONNECTING 0 - /run/php/php8.2-fpm-xx-android.com.sock
unix 3 [ ] STREAM CONNECTED 9776140 1331474/apache2
unix 3 [ ] STREAM CONNECTING 0 - /run/php/php8.2-fpm-xx-android.com.sock
unix 3 [ ] STREAM CONNECTED 19013 1845/nginx: master
unix 3 [ ] STREAM CONNECTED 8847777 132362/nginx: maste
unix 3 [ ] STREAM CONNECTING 0 - /run/php/php8.2-fpm-xx-android.com.sock
unix 3 [ ] STREAM CONNECTED 18701 565/python3
unix 3 [ ] STREAM CONNECTED 9751570 1930738/php-fpm: ma
unix 2 [ ] STREAM CONNECTED 1049817 292951/sshd: root@p
unix 3 [ ] DGRAM CONNECTED 19528 1/init
unix 3 [ ] STREAM CONNECTED 18564 490/@dbus-daemon
unix 3 [ ] STREAM CONNECTED 14946 490/@dbus-daemon /run/dbus/system_bus_socket
unix 3 [ ] STREAM CONNECTED 18304 1/init /run/systemd/journal/stdout
unix 2 [ ] STREAM CONNECTED 9753623 1931820/php-fpm: po
unix 3 [ ] DGRAM CONNECTED 18254 472/systemd-timesyn
unix 2 [ ] STREAM CONNECTED 9755328 1934190/php-fpm: po
unix 3 [ ] STREAM CONNECTED 9771360 1331474/apache2
unix 3 [ ] STREAM CONNECTED 8845942 132362/nginx: maste
unix 3 [ ] STREAM CONNECTED 8847782 132362/nginx: maste
unix 3 [ ] STREAM CONNECTED 8847773 132362/nginx: maste
unix 3 [ ] STREAM CONNECTING 0 - /run/php/php8.2-fpm-xx-android.com.sock
unix 2 [ ] STREAM CONNECTED 9752319 1934448/php-fpm: po
unix 3 [ ] STREAM CONNECTED 15846 506/systemd-logind
unix 3 [ ] STREAM CONNECTING 0 - /run/php/php8.2-fpm-xx-android.com.sock
unix 3 [ ] STREAM CONNECTING 0 - /run/php/php8.2-fpm-xx-android.com.sock
unix 3 [ ] STREAM CONNECTED 15726 1/init /run/systemd/journal/stdout
unix 3 [ ] STREAM CONNECTED 18643 1/init /run/systemd/journal/stdout
unix 2 [ ] DGRAM CONNECTED 18247 472/systemd-timesyn
unix 3 [ ] STREAM CONNECTED 9772669 1331475/apache2
unix 3 [ ] STREAM CONNECTING 0 - /run/php/php8.2-fpm-xx-android.com.sock
unix 3 [ ] STREAM CONNECTED 19757 1/init /run/systemd/journal/stdout
unix 3 [ ] STREAM CONNECTED 1043381 292954/systemd
unix 3 [ ] STREAM CONNECTED 50925 1/init /run/systemd/journal/stdout
unix 2 [ ] DGRAM CONNECTED 48279 12561/named
unix 3 [ ] STREAM CONNECTED 9754057 1933160/php-fpm: po /run/php/php8.2-fpm-xx-android.com.sock
unix 3 [ ] STREAM CONNECTED 8847781 132362/nginx: maste
unix 3 [ ] STREAM CONNECTED 14124 1/init /run/systemd/journal/stdout
unix 3 [ ] STREAM CONNECTED 9760114 1331475/apache2
unix 3 [ ] STREAM CONNECTED 20651 502/python3
unix 3 [ ] STREAM CONNECTED 9760341 1331475/apache2
unix 3 [ ] STREAM CONNECTED 9760140 1331475/apache2
unix 2 [ ] DGRAM CONNECTED 13949 289/systemd-journal
unix 3 [ ] STREAM CONNECTED 19698 489/cron
unix 3 [ ] STREAM CONNECTED 8847770 132362/nginx: maste
unix 3 [ ] DGRAM CONNECTED 21849 536/systemd-network
unix 3 [ ] STREAM CONNECTED 14160 1/init /run/systemd/journal/stdout
unix 3 [ ] STREAM CONNECTING 0 - /run/php/php8.2-fpm-xx-android.com.sock
unix 2 [ ] STREAM CONNECTED 9751411 1933311/php-fpm: po
unix 3 [ ] STREAM CONNECTED 9750638 1/init /run/systemd/journal/stdout
unix 2 [ ] STREAM CONNECTED 9754058 1933160/php-fpm: po
unix 3 [ ] STREAM CONNECTING 0 - /run/php/php8.2-fpm-xx-android.com.sock
unix 2 [ ] DGRAM CONNECTED 19607 1/init
unix 2 [ ] DGRAM CONNECTED 21661 326/systemd-udevd
unix 3 [ ] STREAM CONNECTED 9779345 1331474/apache2
unix 3 [ ] STREAM CONNECTING 0 - /run/php/php8.2-fpm-xx-android.com.sock
unix 3 [ ] STREAM CONNECTED 9759924 1331475/apache2
unix 3 [ ] STREAM CONNECTED 9751410 1933311/php-fpm: po /run/php/php8.2-fpm-xx-android.com.sock
unix 3 [ ] STREAM CONNECTED 123158 1/init /run/systemd/journal/stdout
unix 2 [ ] DGRAM CONNECTED 14935 503/rsyslogd
unix 3 [ ] STREAM CONNECTING 0 - /run/php/php8.2-fpm-xx-android.com.sock
unix 3 [ ] STREAM CONNECTED 9767698 1943883/apache2
unix 3 [ ] STREAM CONNECTED 9756128 1331474/apache2
unix 3 [ ] STREAM CONNECTED 9753622 1931820/php-fpm: po /run/php/php8.2-fpm-xx-android.com.sock
unix 3 [ ] STREAM CONNECTED 15732 1/init
unix 3 [ ] STREAM CONNECTED 117537 37290/packagekitd
unix 3 [ ] STREAM CONNECTED 18285 1/init /run/systemd/journal/stdout
unix 3 [ ] STREAM CONNECTED 20092 1958/php-fpm: maste
unix 3 [ ] DGRAM CONNECTED 21848 536/systemd-network
unix 3 [ ] STREAM CONNECTED 9756816 1331475/apache2
unix 3 [ ] STREAM CONNECTED 9771464 1331474/apache2
unix 3 [ ] STREAM CONNECTED 9771202 1331474/apache2
unix 3 [ ] STREAM CONNECTED 18300 490/@dbus-daemon
unix 3 [ ] STREAM CONNECTED 9755567 1331475/apache2
unix 3 [ ] STREAM CONNECTED 15866 490/@dbus-daemon /run/dbus/system_bus_socket
unix 3 [ ] STREAM CONNECTED 14125 1/init /run/systemd/journal/stdout
unix 3 [ ] STREAM CONNECTED 21736 1/init /run/systemd/journal/stdout
unix 3 [ ] STREAM CONNECTED 24592 1/init /run/systemd/journal/stdout
unix 3 [ ] STREAM CONNECTED 14162 567/vsftpd
unix 3 [ ] STREAM CONNECTED 9751586 1930738/php-fpm: ma
unix 3 [ ] STREAM CONNECTED 9771745 1331474/apache2
unix 3 [ ] STREAM CONNECTED 9762987 1331475/apache2
unix 3 [ ] STREAM CONNECTING 0 - /run/php/php8.2-fpm-xx-android.com.sock
unix 3 [ ] STREAM CONNECTED 14925 501/irqbalance
unix 3 [ ] DGRAM CONNECTED 18251 472/systemd-timesyn
unix 3 [ ] STREAM CONNECTED 9770902 1331474/apache2
unix 3 [ ] STREAM CONNECTING 0 - /run/php/php8.2-fpm-xx-android.com.sock
unix 3 [ ] STREAM CONNECTED 9755327 1934190/php-fpm: po /run/php/php8.2-fpm-xx-android.com.sock
unix 3 [ ] STREAM CONNECTED 9751387 1331475/apache2
unix 3 [ ] STREAM CONNECTED 15025 490/@dbus-daemon /run/dbus/system_bus_socket
unix 3 [ ] STREAM CONNECTED 8845941 132362/nginx: maste
unix 3 [ ] STREAM CONNECTED 21905 502/python3
unix 3 [ ] DGRAM CONNECTED 19529 1/init
unix 3 [ ] STREAM CONNECTED 23690 1672/dovecot
unix 3 [ ] STREAM CONNECTED 18272 472/systemd-timesyn
unix 3 [ ] STREAM CONNECTING 0 - /run/php/php8.2-fpm-xx-android.com.sock
unix 3 [ ] STREAM CONNECTED 9767018 1331474/apache2
unix 3 [ ] STREAM CONNECTED 13992 1/init /run/systemd/journal/stdout
PS
root@vmi2064664:/home/cexxec/web/free-apps-android.com/logs# ps aux
USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND
root 1 0.0 0.0 167152 12656 ? Ss Nov22 2:47 /sbin/init
root 2 0.0 0.0 0 0 ? S Nov22 0:00 [kthreadd]
root 3 0.0 0.0 0 0 ? I< Nov22 0:00 [rcu_gp]
root 4 0.0 0.0 0 0 ? I< Nov22 0:00 [rcu_par_gp]
root 6 0.0 0.0 0 0 ? I< Nov22 0:00 [kworker/0:0H-events_highpri]
root 9 0.0 0.0 0 0 ? I< Nov22 0:00 [mm_percpu_wq]
root 10 0.0 0.0 0 0 ? S Nov22 0:00 [rcu_tasks_rude_]
root 11 0.0 0.0 0 0 ? S Nov22 0:00 [rcu_tasks_trace]
root 12 0.0 0.0 0 0 ? S Nov22 0:13 [ksoftirqd/0]
root 13 0.5 0.0 0 0 ? I Nov22 22:42 [rcu_sched]
root 14 0.0 0.0 0 0 ? S Nov22 0:02 [migration/0]
root 15 0.0 0.0 0 0 ? S Nov22 0:00 [idle_inject/0]
root 16 0.0 0.0 0 0 ? S Nov22 0:00 [cpuhp/0]
root 17 0.0 0.0 0 0 ? S Nov22 0:00 [cpuhp/1]
root 18 0.0 0.0 0 0 ? S Nov22 0:00 [idle_inject/1]
root 19 0.0 0.0 0 0 ? S Nov22 0:02 [migration/1]
root 20 0.0 0.0 0 0 ? S Nov22 0:14 [ksoftirqd/1]
root 22 0.0 0.0 0 0 ? I< Nov22 0:00 [kworker/1:0H-events_highpri]
root 23 0.0 0.0 0 0 ? S Nov22 0:00 [cpuhp/2]
root 24 0.0 0.0 0 0 ? S Nov22 0:00 [idle_inject/2]
root 25 0.0 0.0 0 0 ? S Nov22 0:02 [migration/2]
root 26 0.0 0.0 0 0 ? S Nov22 0:16 [ksoftirqd/2]
root 28 0.0 0.0 0 0 ? I< Nov22 0:00 [kworker/2:0H-events_highpri]
root 29 0.0 0.0 0 0 ? S Nov22 0:00 [cpuhp/3]
root 30 0.0 0.0 0 0 ? S Nov22 0:00 [idle_inject/3]
root 31 0.0 0.0 0 0 ? S Nov22 0:02 [migration/3]
root 32 0.0 0.0 0 0 ? S Nov22 0:15 [ksoftirqd/3]
root 34 0.0 0.0 0 0 ? I< Nov22 0:00 [kworker/3:0H-events_highpri]
root 35 0.0 0.0 0 0 ? S Nov22 0:00 [cpuhp/4]
root 36 0.0 0.0 0 0 ? S Nov22 0:00 [idle_inject/4]
root 37 0.0 0.0 0 0 ? S Nov22 0:02 [migration/4]
root 38 0.0 0.0 0 0 ? S Nov22 0:17 [ksoftirqd/4]
root 40 0.0 0.0 0 0 ? I< Nov22 0:00 [kworker/4:0H-events_highpri]
root 41 0.0 0.0 0 0 ? S Nov22 0:00 [cpuhp/5]
root 42 0.0 0.0 0 0 ? S Nov22 0:00 [idle_inject/5]
root 43 0.0 0.0 0 0 ? S Nov22 0:02 [migration/5]
root 44 0.0 0.0 0 0 ? S Nov22 0:15 [ksoftirqd/5]
root 46 0.0 0.0 0 0 ? I< Nov22 0:00 [kworker/5:0H-events_highpri]
root 47 0.0 0.0 0 0 ? S Nov22 0:00 [cpuhp/6]
root 48 0.0 0.0 0 0 ? S Nov22 0:00 [idle_inject/6]
root 49 0.0 0.0 0 0 ? S Nov22 0:02 [migration/6]
root 50 0.0 0.0 0 0 ? S Nov22 0:12 [ksoftirqd/6]
root 52 0.0 0.0 0 0 ? I< Nov22 0:00 [kworker/6:0H-events_highpri]
root 53 0.0 0.0 0 0 ? S Nov22 0:00 [cpuhp/7]
root 54 0.0 0.0 0 0 ? S Nov22 0:00 [idle_inject/7]
root 55 0.0 0.0 0 0 ? S Nov22 0:02 [migration/7]
root 56 0.0 0.0 0 0 ? S Nov22 0:12 [ksoftirqd/7]
root 58 0.0 0.0 0 0 ? I< Nov22 0:00 [kworker/7:0H-kblockd]
root 59 0.0 0.0 0 0 ? S Nov22 0:00 [kdevtmpfs]
root 60 0.0 0.0 0 0 ? I< Nov22 0:00 [netns]
root 61 0.0 0.0 0 0 ? I< Nov22 0:00 [inet_frag_wq]
root 62 0.0 0.0 0 0 ? S Nov22 0:00 [kauditd]
root 63 0.0 0.0 0 0 ? S Nov22 0:00 [khungtaskd]
root 64 0.0 0.0 0 0 ? S Nov22 0:00 [oom_reaper]
root 65 0.0 0.0 0 0 ? I< Nov22 0:00 [writeback]
root 66 0.0 0.0 0 0 ? S Nov22 0:39 [kcompactd0]
root 67 0.0 0.0 0 0 ? SN Nov22 0:00 [ksmd]
root 68 0.0 0.0 0 0 ? SN Nov22 0:19 [khugepaged]
root 115 0.0 0.0 0 0 ? I< Nov22 0:00 [kintegrityd]
root 116 0.0 0.0 0 0 ? I< Nov22 0:00 [kblockd]
root 117 0.0 0.0 0 0 ? I< Nov22 0:00 [blkcg_punt_bio]
root 118 0.0 0.0 0 0 ? I< Nov22 0:00 [tpm_dev_wq]
root 119 0.0 0.0 0 0 ? I< Nov22 0:00 [ata_sff]
root 120 0.0 0.0 0 0 ? I< Nov22 0:00 [md]
root 121 0.0 0.0 0 0 ? I< Nov22 0:00 [edac-poller]
root 122 0.0 0.0 0 0 ? I< Nov22 0:00 [devfreq_wq]
root 123 0.0 0.0 0 0 ? S Nov22 0:00 [watchdogd]
root 125 0.0 0.0 0 0 ? I< Nov22 0:00 [kworker/0:1H-kblockd]
root 127 0.0 0.0 0 0 ? S Nov22 0:51 [kswapd0]
root 128 0.0 0.0 0 0 ? S Nov22 0:00 [ecryptfs-kthrea]
root 131 0.0 0.0 0 0 ? I< Nov22 0:00 [kthrotld]
root 132 0.0 0.0 0 0 ? I< Nov22 0:00 [acpi_thermal_pm]
root 134 0.0 0.0 0 0 ? S Nov22 0:00 [scsi_eh_0]
root 135 0.0 0.0 0 0 ? I< Nov22 0:00 [scsi_tmf_0]
root 136 0.0 0.0 0 0 ? S Nov22 0:00 [scsi_eh_1]
root 137 0.0 0.0 0 0 ? I< Nov22 0:00 [scsi_tmf_1]
root 139 0.0 0.0 0 0 ? I< Nov22 0:00 [vfio-irqfd-clea]
root 140 0.0 0.0 0 0 ? I< Nov22 0:00 [mld]
root 141 0.0 0.0 0 0 ? I< Nov22 0:01 [kworker/3:1H-kblockd]
root 142 0.0 0.0 0 0 ? I< Nov22 0:00 [ipv6_addrconf]
root 156 0.0 0.0 0 0 ? I< Nov22 0:00 [kstrp]
root 161 0.0 0.0 0 0 ? I< Nov22 0:00 [zswap-shrink]
root 162 0.0 0.0 0 0 ? I< Nov22 0:00 [kworker/u17:0]
root 167 0.0 0.0 0 0 ? I< Nov22 0:00 [charger_manager]
root 189 0.0 0.0 0 0 ? I< Nov22 0:01 [kworker/1:1H-kblockd]
root 221 0.0 0.0 0 0 ? S Nov22 0:00 [scsi_eh_2]
root 223 0.0 0.0 0 0 ? I< Nov22 0:00 [scsi_tmf_2]
root 227 0.0 0.0 0 0 ? I< Nov22 0:02 [kworker/4:1H-kblockd]
root 228 0.0 0.0 0 0 ? I< Nov22 0:00 [kworker/2:1H-kblockd]
root 248 0.0 0.0 0 0 ? I< Nov22 0:01 [kworker/7:1H-kblockd]
root 250 0.0 0.0 0 0 ? S Nov22 0:29 [jbd2/sda3-8]
root 251 0.0 0.0 0 0 ? I< Nov22 0:00 [ext4-rsv-conver]
root 264 0.0 0.0 0 0 ? I< Nov22 0:01 [kworker/6:1H-kblockd]
root 283 0.0 0.0 0 0 ? I< Nov22 0:02 [kworker/5:1H-kblockd]
root 289 0.0 0.1 76764 37312 ? S<s Nov22 1:08 /lib/systemd/systemd-journald
root 326 0.0 0.0 11524 5872 ? Ss Nov22 0:01 /lib/systemd/systemd-udevd
root 360 0.0 0.0 0 0 ? I< Nov22 0:00 [cryptd]
root 403 0.0 0.0 0 0 ? S Nov22 0:00 [jbd2/sda2-8]
root 404 0.0 0.0 0 0 ? I< Nov22 0:00 [ext4-rsv-conver]
systemd+ 472 0.0 0.0 89388 6316 ? Ssl Nov22 0:02 /lib/systemd/systemd-timesyncd
root 488 0.0 0.0 239940 7536 ? Ssl Nov22 0:27 /usr/libexec/accounts-daemon
root 489 0.0 0.0 9520 2860 ? Ss Nov22 0:07 /usr/sbin/cron -f -P
message+ 490 0.0 0.0 8688 4456 ? Ss Nov22 1:32 @dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only
root 501 0.0 0.0 82780 3764 ? Ssl Nov22 0:17 /usr/sbin/irqbalance --foreground
root 502 0.0 0.0 35496 18876 ? Ss Nov22 0:00 /usr/bin/python3 /usr/bin/networkd-dispatcher --run-startup-triggers
syslog 503 0.0 0.0 222408 5720 ? Ssl Nov22 0:33 /usr/sbin/rsyslogd -n -iNONE
root 506 0.0 0.0 15532 7500 ? Ss Nov22 0:47 /lib/systemd/systemd-logind
systemd+ 536 0.0 0.0 16152 7952 ? Ss Nov22 0:01 /lib/systemd/systemd-networkd
root 540 0.0 0.0 234536 6556 ? Ssl Nov22 0:00 /usr/libexec/polkitd --no-debug
systemd+ 545 0.0 0.0 25820 12772 ? Ss Nov22 0:16 /lib/systemd/systemd-resolved
root 549 0.5 0.1 1288744 26520 ? Ssl Nov22 24:53 /usr/bin/python3 /usr/bin/fail2ban-server -xf start
root 565 0.0 0.0 112520 21336 ? Ssl Nov22 0:00 /usr/bin/python3 /usr/share/unattended-upgrades/unattended-upgrade-shutdown --wait-for-signal
root 567 0.0 0.0 10868 5964 ? Ss Nov22 0:00 /usr/sbin/vsftpd /etc/vsftpd.conf
root 572 0.0 0.0 8776 928 tty1 Ss+ Nov22 0:00 /sbin/agetty -o -p -- \u --noclear tty1 linux
root 1672 0.0 0.0 8324 4564 ? Ss Nov22 0:02 /usr/sbin/dovecot -F
dovecot 1755 0.0 0.0 4664 1380 ? S Nov22 0:01 dovecot/anvil
root 1845 0.0 0.0 21224 1324 ? Ss Nov22 0:00 nginx: master process /usr/local/hestia/nginx/sbin/hestia-nginx
admin 1846 0.0 0.0 22500 7556 ? S Nov22 0:02 nginx: worker process
Debian-+ 1957 0.0 0.1 52540 27028 ? Ss Nov22 0:13 /usr/sbin/exim4 -bd -q30m
root 1958 0.0 0.0 83888 7080 ? Ss Nov22 0:24 php-fpm: master process (/usr/local/hestia/php/etc/php-fpm.conf)
bind 12561 0.0 0.0 1605624 13628 ? Ssl Nov22 0:45 /usr/sbin/named -u bind
root 16093 0.0 0.0 15456 8232 ? Ss Nov22 0:13 sshd: /usr/sbin/sshd -D [listener] 0 of 10-100 startups
root 37290 0.0 0.0 298228 18756 ? Ssl Nov22 0:03 /usr/libexec/packagekitd
mysql 54854 0.1 2.3 2543724 578480 ? Ssl Nov22 7:53 /usr/sbin/mariadbd
root 54857 0.0 0.0 0 0 ? S Nov22 0:00 [psimon]
root 132362 0.0 0.0 55504 9720 ? Ss Nov23 0:00 nginx: master process /usr/sbin/nginx -c /etc/nginx/nginx.conf
root 133164 0.0 0.0 17828 12320 ? Ss Nov23 0:24 /usr/sbin/apache2 -k start
root 292951 0.0 0.0 17192 10824 ? Ss Nov23 1:44 sshd: root@pts/0
root 292954 0.0 0.0 16964 9288 ? Ss Nov23 0:00 /lib/systemd/systemd --user
root 292955 0.0 0.0 169148 3804 ? S Nov23 0:00 (sd-pam)
root 292981 0.0 0.0 11376 4752 pts/0 Ss Nov23 0:00 -bash
root 295315 18.7 0.0 25836 19508 pts/0 S+ Nov23 526:21 bash /usr/local/sbin/maldet --scan-all /home
root 338646 0.0 0.0 17348 10588 ? Ss Nov23 0:00 sshd: root@pts/1
root 338833 0.0 0.0 11388 5560 pts/1 Ss Nov23 0:00 -bash
root 571493 0.0 0.0 0 0 ? I 01:17 0:07 [kworker/2:1-events]
root 698274 0.0 0.0 0 0 ? I 02:24 0:05 [kworker/5:0-mm_percpu_wq]
root 1115824 0.0 0.0 0 0 ? I 06:07 0:05 [kworker/1:1-mm_percpu_wq]
root 1115826 0.0 0.0 0 0 ? I 06:07 0:04 [kworker/3:0-mm_percpu_wq]
www-data 1331460 0.0 0.0 17720 5972 ? S 07:50 0:00 /usr/sbin/apache2 -k start
www-data 1331474 0.0 0.1 1951276 25452 ? Sl 07:50 0:12 /usr/sbin/apache2 -k start
www-data 1331475 0.0 0.0 1950280 24568 ? Sl 07:50 0:07 /usr/sbin/apache2 -k start
root 1331568 0.0 0.0 4804 2984 ? S 07:50 0:00 dovecot/log
www-data 1332068 0.0 0.0 55816 10824 ? S 07:50 0:00 nginx: worker process
www-data 1332069 0.2 0.0 55816 13208 ? S 07:50 0:41 nginx: worker process
www-data 1332070 0.0 0.0 55816 11620 ? S 07:50 0:00 nginx: worker process
www-data 1332071 0.0 0.0 55816 10760 ? S 07:50 0:00 nginx: worker process
www-data 1332075 0.0 0.0 55816 10760 ? S 07:50 0:00 nginx: worker process
www-data 1332077 0.0 0.0 55816 10760 ? S 07:50 0:00 nginx: worker process
www-data 1332079 0.0 0.0 55816 6772 ? S 07:50 0:00 nginx: worker process
www-data 1332081 0.0 0.0 55816 10824 ? S 07:50 0:00 nginx: worker process
www-data 1332082 0.0 0.0 55816 6456 ? S 07:50 0:00 nginx: cache manager process
root 1335585 0.0 0.0 6912 4804 ? S 07:52 0:00 dovecot/config
dovecot 1335586 0.0 0.0 5760 3432 ? S 07:52 0:00 dovecot/stats
root 1540134 0.0 0.0 0 0 ? I 09:43 0:01 [kworker/6:0-mm_percpu_wq]
root 1664082 0.0 0.0 0 0 ? I 10:51 0:01 [kworker/7:2-mm_percpu_wq]
root 1769443 0.0 0.0 0 0 ? I 11:47 0:00 [kworker/4:1-events]
root 1771747 0.0 0.0 0 0 ? I 11:48 0:01 [kworker/0:1-events]
root 1865752 0.0 0.0 0 0 ? I 12:42 0:01 [kworker/u16:3-events_unbound]
root 1894573 0.0 0.0 0 0 ? I 12:57 0:00 [kworker/6:2-events]
root 1914364 0.0 0.0 0 0 ? I 13:08 0:00 [kworker/1:0]
root 1917248 0.0 0.0 0 0 ? I 13:10 0:00 [kworker/3:2-events]
root 1922335 0.0 0.0 0 0 ? I 13:12 0:00 [kworker/u16:1-events_unbound]
root 1925511 0.0 0.0 0 0 ? I 13:14 0:00 [kworker/5:2-events]
root 1926981 0.0 0.0 0 0 ? I 13:14 0:00 [kworker/2:0-events]
root 1926982 0.0 0.0 0 0 ? I 13:14 0:00 [kworker/0:0-events]
root 1928302 0.0 0.0 0 0 ? I 13:14 0:00 [kworker/u16:4-events_power_efficient]
root 1929094 0.0 0.0 0 0 ? I 13:14 0:00 [kworker/7:1]
root 1929097 0.0 0.0 0 0 ? I 13:14 0:00 [kworker/4:2-mm_percpu_wq]
root 1930738 0.0 0.1 305548 40936 ? Ss 13:14 0:00 php-fpm: master process (/etc/php/8.2/fpm/php-fpm.conf)
cexxec 1931820 82.3 7.1 2012020 1765616 ? R 13:15 7:58 php-fpm: pool xx-android.com
cexxec 1933160 86.8 7.2 2040704 1785148 ? R 13:15 8:12 php-fpm: pool xx-android.com
cexxec 1933311 86.8 7.2 2042752 1787400 ? R 13:15 8:08 php-fpm: pool xx-android.com
cexxec 1933711 86.2 6.9 1964928 1709660 ? R 13:15 7:52 php-fpm: pool xx-android.com
cexxec 1933791 86.4 6.9 1962880 1708472 ? R 13:15 7:51 php-fpm: pool xx-android.com
cexxec 1934190 86.1 6.6 1903488 1647772 ? R 13:15 7:35 php-fpm: pool xx-android.com
cexxec 1934448 81.9 6.2 1801088 1545944 ? R 13:16 7:04 php-fpm: pool xx-android.com
cexxec 1934592 86.4 6.4 1854336 1599080 ? R 13:16 7:22 php-fpm: pool xx-android.com
www-data 1943883 0.0 0.0 1944136 10916 ? Sl 13:21 0:00 /usr/sbin/apache2 -k start
root 1945838 0.0 0.0 0 0 ? I 13:23 0:00 [kworker/2:2-events]
root 1947954 0.0 0.0 25836 17476 pts/0 S+ 13:24 0:00 bash /usr/local/sbin/maldet --scan-all /home
root 1947955 0.0 0.0 25836 17440 pts/0 R+ 13:24 0:00 bash /usr/local/sbin/maldet --scan-all /home
root 1947956 0.0 0.0 25836 17440 pts/0 R+ 13:24 0:00 bash /usr/local/sbin/maldet --scan-all /home
root 1947957 0.0 0.0 12672 1540 pts/1 R+ 13:24 0:00 ps aux
top - 22:05:16 up 9:39, 2 users, load average: 8.47, 8.44, 8.34
Tasks: 186 total, 9 running, 177 sleeping, 0 stopped, 0 zombie
%Cpu(s): 24.5 us, 75.0 sy, 0.0 ni, 0.0 id, 0.0 wa, 0.0 hi, 0.5 si, 0.0 st
MiB Mem : 24028.4 total, 21731.1 free, 1976.3 used, 320.9 buff/cache
MiB Swap: 0.0 total, 0.0 free, 0.0 used. 21631.2 avail Mem
PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND
98564 cezar 20 0 849920 208708 49496 R 100.0 0.8 62:08.36 php-fpm8.2
98534 cezar 20 0 851968 210456 49496 R 99.7 0.9 63:26.05 php-fpm8.2
98538 cezar 20 0 849920 210156 49500 R 99.7 0.9 62:40.28 php-fpm8.2
97677 cezar 20 0 928264 243544 80036 R 99.3 1.0 70:59.62 php-fpm8.2
97678 cezar 20 0 857808 250836 83868 R 99.3 1.0 70:28.52 php-fpm8.2
98536 cezar 20 0 851968 211564 49500 R 99.0 0.9 63:13.34 php-fpm8.2
98563 cezar 20 0 847872 206700 49504 R 97.4 0.8 62:27.47 php-fpm8.2
98535 cezar 20 0 851968 210292 49500 R 96.7 0.9 63:23.76 php-fpm8.2
21241 www-data 20 0 2014636 25264 7552 S 2.6 0.1 0:25.69 apache2
89741 root 20 0 0 0 0 I 2.6 0.0 0:01.04 kworker/3:2-mm_percpu_wq
39255 www-data 20 0 57988 13656 7352 S 0.7 0.1 1:47.86 nginx
509 root 20 0 1287860 24932 11300 S 0.3 0.1 2:34.31 fail2ban-server
512 root 20 0 82780 3740 3380 S 0.3 0.0 0:02.68 irqbalance
74610 root 20 0 10968 4580 3540 S 0.3 0.0 1:41.31 htop
TOTAL FILES: 513968
TOTAL HITS: 0
TOTAL CLEANED: 0
===============================================
Linux Malware Detect v1.6.5 < [email protected] >
See what the php-fpm procs have open, eg:
lsof -p 98564
Replacing that PID with a current one
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
php-fpm8. 32419 cezar cwd DIR 8,3 4096 18219116 /home/cezar/web/xx-android.com/public_html
php-fpm8. 32419 cezar rtd DIR 8,3 4096 2 /
php-fpm8. 32419 cezar txt REG 8,3 5664328 13765749 /usr/sbin/php-fpm8.2
php-fpm8. 32419 cezar DEL REG 0,1 5142 /dev/zero
php-fpm8. 32419 cezar DEL REG 0,1 5140 /dev/zero
php-fpm8. 32419 cezar mem REG 8,3 309600 14156195 /usr/lib/x86_64-linux-gnu/libnss_systemd.so.2
php-fpm8. 32419 cezar mem REG 8,3 118480 14159955 /usr/lib/x86_64-linux-gnu/libzip.so.4.0
php-fpm8. 32419 cezar mem REG 8,3 96520 15734181 /usr/lib/php/20220829/zip.so
php-fpm8. 32419 cezar mem REG 8,3 96416 14160335 /usr/lib/x86_64-linux-gnu/libexslt.so.0.8.20
php-fpm8. 32419 cezar mem REG 8,3 264632 14160336 /usr/lib/x86_64-linux-gnu/libxslt.so.1.1.34
php-fpm8. 32419 cezar mem REG 8,3 39176 15734180 /usr/lib/php/20220829/xsl.so
php-fpm8. 32419 cezar mem REG 8,3 51464 15734179 /usr/lib/php/20220829/xmlwriter.so
php-fpm8. 32419 cezar mem REG 8,3 47368 15734178 /usr/lib/php/20220829/xmlreader.so
php-fpm8. 32419 cezar mem REG 8,3 35080 15731611 /usr/lib/php/20220829/tokenizer.so
php-fpm8. 32419 cezar mem REG 8,3 22792 15731610 /usr/lib/php/20220829/sysvshm.so
php-fpm8. 32419 cezar mem REG 8,3 14600 15731609 /usr/lib/php/20220829/sysvsem.so
php-fpm8. 32419 cezar mem REG 8,3 22792 15731608 /usr/lib/php/20220829/sysvmsg.so
php-fpm8. 32419 cezar mem REG 8,3 104712 15731607 /usr/lib/php/20220829/sockets.so
php-fpm8. 32419 cezar mem REG 8,3 342280 15734174 /usr/lib/php/20220829/soap.so
php-fpm8. 32419 cezar mem REG 8,3 63752 15734176 /usr/lib/php/20220829/simplexml.so
php-fpm8. 32419 cezar mem REG 8,3 200136 14156161 /usr/lib/x86_64-linux-gnu/libtinfo.so.6.3
php-fpm8. 32419 cezar mem REG 8,3 216376 14157680 /usr/lib/x86_64-linux-gnu/libedit.so.2.0.68
php-fpm8. 32419 cezar mem REG 8,3 39176 15731655 /usr/lib/php/20220829/readline.so
php-fpm8. 32419 cezar mem REG 8,3 620976 14159876 /usr/lib/x86_64-linux-gnu/libaspell.so.15.3.1
php-fpm8. 32419 cezar mem REG 8,3 26888 15734173 /usr/lib/php/20220829/pspell.so
php-fpm8. 32419 cezar mem REG 8,3 293128 15731604 /usr/lib/php/20220829/phar.so
php-fpm8. 32419 cezar mem REG 8,3 166152 15734170 /usr/lib/php/20220829/mysqli.so
php-fpm8. 32419 cezar mem REG 8,3 597344 14159947 /usr/lib/x86_64-linux-gnu/libonig.so.5.2.0
php-fpm8. 32419 cezar mem REG 8,3 1196960 15734169 /usr/lib/php/20220829/mbstring.so
php-fpm8. 32419 cezar mem REG 8,3 104712 15734168 /usr/lib/php/20220829/ldap.so
php-fpm8. 32419 cezar mem REG 8,3 3328472 14156961 /usr/lib/x86_64-linux-gnu/libicui18n.so.70.1
php-fpm8. 32419 cezar mem REG 8,3 592224 15734167 /usr/lib/php/20220829/intl.so
php-fpm8. 32419 cezar mem REG 8,3 2201936 14159804 /usr/lib/x86_64-linux-gnu/libfftw3.so.3.5.8
php-fpm8. 32419 cezar mem REG 8,3 55304 14159826 /usr/lib/x86_64-linux-gnu/liblqr-1.so.0.3.2
php-fpm8. 32419 cezar mem REG 8,3 43272 15731605 /usr/lib/php/20220829/posix.so
php-fpm8. 32419 cezar mem REG 8,3 35080 15734172 /usr/lib/php/20220829/pdo_mysql.so
php-fpm8. 32419 cezar mem REG 8,3 63880 14157604 /usr/lib/x86_64-linux-gnu/libicuio.so.70.1
php-fpm8. 32419 cezar DEL REG 0,1 5144 /dev/zero
php-fpm8. 32419 cezar mem REG 8,3 27072 14157628 /usr/lib/x86_64-linux-gnu/libcap-ng.so.0.0.0
php-fpm8. 32419 cezar mem REG 8,3 133200 14157681 /usr/lib/x86_64-linux-gnu/libaudit.so.1.0.0
php-fpm8. 32419 cezar mem REG 8,3 67736 14157033 /usr/lib/x86_64-linux-gnu/libpam.so.0.85.1
php-fpm8. 32419 cezar mem REG 8,3 1099432 13765825 /usr/lib/libc-client.so.2007e.0
php-fpm8. 32419 cezar mem REG 8,3 112904 15734166 /usr/lib/php/20220829/imap.so
php-fpm8. 32419 cezar mem REG 8,3 39384 14159828 /usr/lib/x86_64-linux-gnu/libltdl.so.7.3.1
php-fpm8. 32419 cezar mem REG 8,3 81640 14157687 /usr/lib/x86_64-linux-gnu/libXext.so.6.4.0
php-fpm8. 32419 cezar mem REG 8,3 390144 14159824 /usr/lib/x86_64-linux-gnu/liblcms2.so.2.0.12
php-fpm8. 32419 cezar mem REG 8,3 2817568 14159841 /usr/lib/x86_64-linux-gnu/libMagickCore-6.Q16.so.6.0.0
php-fpm8. 32419 cezar mem REG 8,3 1223088 14159843 /usr/lib/x86_64-linux-gnu/libMagickWand-6.Q16.so.6.0.0
php-fpm8. 32419 cezar mem REG 8,3 18696 15731606 /usr/lib/php/20220829/shmop.so
php-fpm8. 32419 cezar mem REG 8,3 465200 15731677 /usr/lib/php/20220829/imagick.so
php-fpm8. 32419 cezar mem REG 8,3 51464 15731602 /usr/lib/php/20220829/iconv.so
php-fpm8. 32419 cezar mem REG 8,3 22688 14160015 /usr/lib/x86_64-linux-gnu/libabsl_throw_delegate.so.20210324.0.0
php-fpm8. 32419 cezar mem REG 8,3 18656 14160012 /usr/lib/x86_64-linux-gnu/libabsl_strings_internal.so.20210324.0.0
php-fpm8. 32419 cezar mem REG 8,3 47472 14158037 /usr/lib/x86_64-linux-gnu/libmd.so.0.0.5
php-fpm8. 32419 cezar mem REG 8,3 26856 14159985 /usr/lib/x86_64-linux-gnu/libabsl_int128.so.20210324.0.0
php-fpm8. 32419 cezar mem REG 8,3 100672 14160017 /usr/lib/x86_64-linux-gnu/libabsl_time_zone.so.20210324.0.0
php-fpm8. 32419 cezar mem REG 8,3 121144 14160011 /usr/lib/x86_64-linux-gnu/libabsl_strings.so.20210324.0.0
php-fpm8. 32419 cezar mem REG 8,3 39224 14159967 /usr/lib/x86_64-linux-gnu/libabsl_demangle_internal.so.20210324.0.0
php-fpm8. 32419 cezar mem REG 8,3 22776 14159966 /usr/lib/x86_64-linux-gnu/libabsl_debugging_internal.so.20210324.0.0
php-fpm8. 32419 cezar mem REG 8,3 89096 14157603 /usr/lib/x86_64-linux-gnu/libbsd.so.0.11.5
php-fpm8. 32419 cezar mem REG 8,3 14536 14160003 /usr/lib/x86_64-linux-gnu/libabsl_raw_logging_internal.so.20210324.0.0
php-fpm8. 32419 cezar mem REG 8,3 14496 14160005 /usr/lib/x86_64-linux-gnu/libabsl_spinlock_wait.so.20210324.0.0
php-fpm8. 32419 cezar mem REG 8,3 22776 14159962 /usr/lib/x86_64-linux-gnu/libabsl_base.so.20210324.0.0
php-fpm8. 32419 cezar mem REG 8,3 18744 14159989 /usr/lib/x86_64-linux-gnu/libabsl_malloc_internal.so.20210324.0.0
php-fpm8. 32419 cezar mem REG 8,3 72232 14160016 /usr/lib/x86_64-linux-gnu/libabsl_time.so.20210324.0.0
php-fpm8. 32419 cezar mem REG 8,3 30952 14160013 /usr/lib/x86_64-linux-gnu/libabsl_symbolize.so.20210324.0.0
php-fpm8. 32419 cezar mem REG 8,3 14256 14160006 /usr/lib/x86_64-linux-gnu/libabsl_stacktrace.so.20210324.0.0
php-fpm8. 32419 cezar mem REG 8,3 26856 14159982 /usr/lib/x86_64-linux-gnu/libabsl_graphcycles_internal.so.20210324.0.0
php-fpm8. 32419 cezar mem REG 8,3 26800 14157064 /usr/lib/x86_64-linux-gnu/libXdmcp.so.6.0.0
php-fpm8. 32419 cezar mem REG 8,3 18720 14157701 /usr/lib/x86_64-linux-gnu/libXau.so.6.0.0
php-fpm8. 32419 cezar mem REG 8,3 485744 14159782 /usr/lib/x86_64-linux-gnu/libpcre.so.3.13.3
php-fpm8. 32419 cezar mem REG 8,3 59864 14160014 /usr/lib/x86_64-linux-gnu/libabsl_synchronization.so.20210324.0.0
php-fpm8. 32419 cezar mem REG 8,3 48152 14156976 /usr/lib/x86_64-linux-gnu/libnuma.so.1.0.0
php-fpm8. 32419 cezar mem REG 8,3 166504 14157054 /usr/lib/x86_64-linux-gnu/libxcb.so.1.1.0
php-fpm8. 32419 cezar mem REG 8,3 153904 14160094 /usr/lib/x86_64-linux-gnu/libgraphite2.so.3.2.1
php-fpm8. 32419 cezar mem REG 8,3 1277712 14159388 /usr/lib/x86_64-linux-gnu/libglib-2.0.so.0.7200.4
php-fpm8. 32419 cezar mem REG 8,3 526424 14160086 /usr/lib/x86_64-linux-gnu/libyuv.so.0.0.1807
php-fpm8. 32419 cezar mem REG 8,3 882848 14160084 /usr/lib/x86_64-linux-gnu/libgav1.so.0.0.1
php-fpm8. 32419 cezar mem REG 8,3 1316784 14159814 /usr/lib/x86_64-linux-gnu/libdav1d.so.5.1.1
php-fpm8. 32419 cezar mem REG 8,3 16071296 14159818 /usr/lib/x86_64-linux-gnu/libx265.so.199
php-fpm8. 32419 cezar mem REG 8,3 715104 14159816 /usr/lib/x86_64-linux-gnu/libde265.so.0.1.1
php-fpm8. 32419 cezar mem REG 8,3 5383376 14159812 /usr/lib/x86_64-linux-gnu/libaom.so.3.3.0
php-fpm8. 32419 cezar mem REG 8,3 141344 14159832 /usr/lib/x86_64-linux-gnu/libdeflate.so.0
php-fpm8. 32419 cezar mem REG 8,3 66568 14159821 /usr/lib/x86_64-linux-gnu/libjbig.so.0
php-fpm8. 32419 cezar mem REG 8,3 1306280 14156917 /usr/lib/x86_64-linux-gnu/libX11.so.6.4.0
php-fpm8. 32419 cezar mem REG 8,3 298776 14159802 /usr/lib/x86_64-linux-gnu/libgomp.so.1.0.0
php-fpm8. 32419 cezar mem REG 8,3 30936 14156174 /usr/lib/x86_64-linux-gnu/libuuid.so.1.3.0
php-fpm8. 32419 cezar mem REG 8,3 194872 14157751 /usr/lib/x86_64-linux-gnu/libexpat.so.1.8.7
php-fpm8. 32419 cezar mem REG 8,3 108864 14158000 /usr/lib/x86_64-linux-gnu/libfribidi.so.0.4.0
php-fpm8. 32419 cezar mem REG 8,3 844624 14160097 /usr/lib/x86_64-linux-gnu/libharfbuzz.so.0.20704.0
php-fpm8. 32419 cezar mem REG 8,3 137464 14160091 /usr/lib/x86_64-linux-gnu/libavif.so.13.0.0
php-fpm8. 32419 cezar mem REG 8,3 530624 14159819 /usr/lib/x86_64-linux-gnu/libheif.so.1.12.0
php-fpm8. 32419 cezar mem REG 8,3 432688 14159833 /usr/lib/x86_64-linux-gnu/libwebp.so.7.1.3
php-fpm8. 32419 cezar mem REG 8,3 551080 14159835 /usr/lib/x86_64-linux-gnu/libtiff.so.5.7.0
php-fpm8. 32419 cezar mem REG 8,3 80800 14160101 /usr/lib/x86_64-linux-gnu/libXpm.so.4.11.0
php-fpm8. 32419 cezar mem REG 8,3 63480 14160093 /usr/lib/x86_64-linux-gnu/libimagequant.so.0
php-fpm8. 32419 cezar mem REG 8,3 522960 14159822 /usr/lib/x86_64-linux-gnu/libjpeg.so.8.2.2
php-fpm8. 32419 cezar mem REG 8,3 813128 14159083 /usr/lib/x86_64-linux-gnu/libfreetype.so.6.18.1
php-fpm8. 32419 cezar mem REG 8,3 298120 14159810 /usr/lib/x86_64-linux-gnu/libfontconfig.so.1.12.0
php-fpm8. 32419 cezar mem REG 8,3 26616 14160099 /usr/lib/x86_64-linux-gnu/libraqm.so.0.700.0
php-fpm8. 32419 cezar mem REG 8,3 235592 14158302 /usr/lib/x86_64-linux-gnu/libpng16.so.16.37.0
php-fpm8. 32419 cezar mem REG 8,3 418088 14160103 /usr/lib/x86_64-linux-gnu/libgd.so.3.0.11
php-fpm8. 32419 cezar mem REG 8,3 112904 15734165 /usr/lib/php/20220829/gd.so
php-fpm8. 32419 cezar mem REG 8,3 71944 15731600 /usr/lib/php/20220829/ftp.so
php-fpm8. 32419 cezar mem REG 8,3 7153984 15731599 /usr/lib/php/20220829/fileinfo.so
php-fpm8. 32419 cezar mem REG 8,3 182536 15731598 /usr/lib/php/20220829/ffi.so
php-fpm8. 32419 cezar mem REG 8,3 96520 15731597 /usr/lib/php/20220829/exif.so
php-fpm8. 32419 cezar mem REG 8,3 203016 15734175 /usr/lib/php/20220829/dom.so
php-fpm8. 32419 cezar mem REG 8,3 47688 14158312 /usr/lib/x86_64-linux-gnu/libffi.so.8.1.0
php-fpm8. 32419 cezar mem REG 8,3 68552 14160434 /usr/lib/x86_64-linux-gnu/libresolv.so.2
php-fpm8. 32419 cezar mem REG 8,3 22600 14158314 /usr/lib/x86_64-linux-gnu/libkeyutils.so.1.9
php-fpm8. 32419 cezar mem REG 8,3 92312 14157085 /usr/lib/x86_64-linux-gnu/libtasn1.so.6.6.2
php-fpm8. 32419 cezar mem REG 8,3 1285888 14158226 /usr/lib/x86_64-linux-gnu/libp11-kit.so.0.3.0
php-fpm8. 32419 cezar mem REG 8,3 141664 14158323 /usr/lib/x86_64-linux-gnu/libbrotlicommon.so.1.1.0
php-fpm8. 32419 cezar mem REG 8,3 105392 14156226 /usr/lib/x86_64-linux-gnu/libsasl2.so.2.0.25
php-fpm8. 32419 cezar mem REG 8,3 52016 14156260 /usr/lib/x86_64-linux-gnu/libkrb5support.so.0.1
php-fpm8. 32419 cezar mem REG 8,3 18504 14156267 /usr/lib/x86_64-linux-gnu/libcom_err.so.2.1
php-fpm8. 32419 cezar mem REG 8,3 182864 14156256 /usr/lib/x86_64-linux-gnu/libk5crypto.so.3.1
php-fpm8. 32419 cezar mem REG 8,3 827936 14156263 /usr/lib/x86_64-linux-gnu/libkrb5.so.3.3
php-fpm8. 32419 cezar mem REG 8,3 526896 14158248 /usr/lib/x86_64-linux-gnu/libgmp.so.10.4.1
php-fpm8. 32419 cezar mem REG 8,3 281000 14157590 /usr/lib/x86_64-linux-gnu/libnettle.so.8.4
php-fpm8. 32419 cezar mem REG 8,3 289800 14157052 /usr/lib/x86_64-linux-gnu/libhogweed.so.6.4
php-fpm8. 32419 cezar mem REG 8,3 2000320 14157654 /usr/lib/x86_64-linux-gnu/libgnutls.so.30.31.0
php-fpm8. 32419 cezar mem REG 8,3 1743016 14157022 /usr/lib/x86_64-linux-gnu/libunistring.so.2.2.0
php-fpm8. 32419 cezar mem REG 8,3 51536 14158383 /usr/lib/x86_64-linux-gnu/libbrotlidec.so.1.1.0
php-fpm8. 32419 cezar mem REG 8,3 63992 14156176 /usr/lib/x86_64-linux-gnu/liblber-2.5.so.0.1.13
php-fpm8. 32419 cezar mem REG 8,3 376512 14156198 /usr/lib/x86_64-linux-gnu/libldap-2.5.so.0.1.13
php-fpm8. 32419 cezar mem REG 8,3 338648 14156265 /usr/lib/x86_64-linux-gnu/libgssapi_krb5.so.2.2
php-fpm8. 32419 cezar mem REG 8,3 75768 14158283 /usr/lib/x86_64-linux-gnu/libpsl.so.5.3.2
php-fpm8. 32419 cezar mem REG 8,3 441944 14157624 /usr/lib/x86_64-linux-gnu/libssh.so.4.8.7
php-fpm8. 32419 cezar mem REG 8,3 121864 14158310 /usr/lib/x86_64-linux-gnu/librtmp.so.1
php-fpm8. 32419 cezar mem REG 8,3 129096 14157063 /usr/lib/x86_64-linux-gnu/libidn2.so.0.3.7
php-fpm8. 32419 cezar mem REG 8,3 166288 14158041 /usr/lib/x86_64-linux-gnu/libnghttp2.so.14.20.1
php-fpm8. 32419 cezar mem REG 8,3 677656 14156145 /usr/lib/x86_64-linux-gnu/libcurl.so.4.7.0
php-fpm8. 32419 cezar mem REG 8,3 18696 15731601 /usr/lib/php/20220829/gettext.so
php-fpm8. 32419 cezar mem REG 8,3 125192 15734164 /usr/lib/php/20220829/curl.so
php-fpm8. 32419 cezar mem REG 8,3 39176 15731595 /usr/lib/php/20220829/calendar.so
php-fpm8. 32419 cezar mem REG 8,3 74848 14157066 /usr/lib/x86_64-linux-gnu/libbz2.so.1.0.4
php-fpm8. 32419 cezar mem REG 8,3 14600 15731596 /usr/lib/php/20220829/ctype.so
php-fpm8. 32419 cezar mem REG 8,3 30984 15734163 /usr/lib/php/20220829/bz2.so
php-fpm8. 32419 cezar mem REG 8,3 92424 15731676 /usr/lib/php/20220829/apcu.so
php-fpm8. 32419 cezar mem REG 8,3 59656 15734177 /usr/lib/php/20220829/xml.so
php-fpm8. 32419 cezar mem REG 8,3 133384 15731603 /usr/lib/php/20220829/pdo.so
php-fpm8. 32419 cezar mem REG 8,3 239472 15734171 /usr/lib/php/20220829/mysqlnd.so
php-fpm8. 32419 cezar mem REG 8,3 1018920 15731648 /usr/lib/php/20220829/opcache.so
php-fpm8. 32419 cezar mem REG 8,3 5712208 13897352 /usr/lib/locale/locale-archive
php-fpm8. 32419 cezar mem REG 8,3 39176 15734162 /usr/lib/php/20220829/bcmath.so
php-fpm8. 32419 cezar mem REG 8,3 353616 13896713 /usr/lib/locale/C.utf8/LC_CTYPE
php-fpm8. 32419 cezar mem REG 8,3 125488 14156158 /usr/lib/x86_64-linux-gnu/libgcc_s.so.1
php-fpm8. 32419 cezar mem REG 8,3 2260296 14156168 /usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.30
php-fpm8. 32419 cezar mem REG 8,3 29476472 14158285 /usr/lib/x86_64-linux-gnu/libicudata.so.70.1
php-fpm8. 32419 cezar mem REG 8,3 149760 14157060 /usr/lib/x86_64-linux-gnu/libgpg-error.so.0.32.1
php-fpm8. 32419 cezar mem REG 8,3 2062664 14158240 /usr/lib/x86_64-linux-gnu/libicuuc.so.70.1
php-fpm8. 32419 cezar mem REG 8,3 1296312 14157589 /usr/lib/x86_64-linux-gnu/libgcrypt.so.20.3.4
php-fpm8. 32419 cezar mem REG 8,3 39024 14156979 /usr/lib/x86_64-linux-gnu/libcap.so.2.44
php-fpm8. 32419 cezar mem REG 8,3 125152 14157003 /usr/lib/x86_64-linux-gnu/liblz4.so.1.9.3
php-fpm8. 32419 cezar mem REG 8,3 841808 14156969 /usr/lib/x86_64-linux-gnu/libzstd.so.1.4.8
php-fpm8. 32419 cezar mem REG 8,3 170456 14158066 /usr/lib/x86_64-linux-gnu/liblzma.so.5.2.5
php-fpm8. 32419 cezar mem REG 8,3 2220400 14160421 /usr/lib/x86_64-linux-gnu/libc.so.6
php-fpm8. 32419 cezar mem REG 8,3 35000 14157062 /usr/lib/x86_64-linux-gnu/libargon2.so.1
php-fpm8. 32419 cezar mem REG 8,3 355040 14158072 /usr/lib/x86_64-linux-gnu/libsodium.so.23.3.0
php-fpm8. 32419 cezar mem REG 8,3 108936 14157049 /usr/lib/x86_64-linux-gnu/libz.so.1.2.11
php-fpm8. 32419 cezar mem REG 8,3 637632 14158292 /usr/lib/x86_64-linux-gnu/libpcre2-8.so.0.11.2
php-fpm8. 32419 cezar mem REG 8,3 4455728 14157759 /usr/lib/x86_64-linux-gnu/libcrypto.so.3
php-fpm8. 32419 cezar mem REG 8,3 667864 14157760 /usr/lib/x86_64-linux-gnu/libssl.so.3
php-fpm8. 32419 cezar mem REG 8,3 1967384 14157027 /usr/lib/x86_64-linux-gnu/libxml2.so.2.9.14
php-fpm8. 32419 cezar mem REG 8,3 807936 14157896 /usr/lib/x86_64-linux-gnu/libsystemd.so.0.32.0
php-fpm8. 32419 cezar mem REG 8,3 34888 14158088 /usr/lib/x86_64-linux-gnu/libacl.so.1.1.2301
php-fpm8. 32419 cezar mem REG 8,3 80768 14157749 /usr/lib/x86_64-linux-gnu/libapparmor.so.1.8.2
php-fpm8. 32419 cezar mem REG 8,3 940560 14160424 /usr/lib/x86_64-linux-gnu/libm.so.6
php-fpm8. 32419 cezar mem REG 8,3 27002 14160687 /usr/lib/x86_64-linux-gnu/gconv/gconv-modules.cache
php-fpm8. 32419 cezar mem REG 8,3 240936 14157691 /usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2
php-fpm8. 32419 cezar 0u CHR 1,3 0t0 5 /dev/null
php-fpm8. 32419 cezar 1u CHR 1,3 0t0 5 /dev/null
php-fpm8. 32419 cezar 2u CHR 1,3 0t0 5 /dev/null
php-fpm8. 32419 cezar 3ur REG 8,3 0 18481165 /tmp/.ZendSem.gI4OiI (deleted)
php-fpm8. 32419 cezar 4u unix 0xffff8e6791233fc0 0t0 104684 type=STREAM
php-fpm8. 32419 cezar 5u unix 0xffff8e6ac5371540 0t0 112699 /run/php/php8.2-fpm-xx-android.com.sock type=STREAM
php-fpm8. 32419 cezar 6u unix 0xffff8e678863a640 0t0 112700 type=STREAM
php-fpm8. 32419 cezar 12u unix 0xffff8e6791230440 0t0 104701 /run/php/php8.2-fpm-xx-android.com.sock type=STREAM
root@vmi2064664:~#
Nothing obvious there. Sorry but I don’t think there’s much I can do without looking directly.
I’d suggest hiring a server expert at this point to take a look
I disabled the W3 Total Cache plugin and i see that things go to normal, i don`t have any clue why