UID PID PPID C STIME TTY TIME CMD root 1 0 0 Feb14 ? 00:21:22 /sbin/init root 2 0 0 Feb14 ? 00:00:00 [kthreadd] root 3 2 0 Feb14 ? 00:00:00 [rcu_gp] root 4 2 0 Feb14 ? 00:00:00 [rcu_par_gp] root 5 2 0 Feb14 ? 00:00:00 [slub_flushwq] root 6 2 0 Feb14 ? 00:00:00 [netns] root 8 2 0 Feb14 ? 00:00:00 [kworker/0:0H-events_highpri] root 10 2 0 Feb14 ? 00:00:00 [mm_percpu_wq] root 11 2 0 Feb14 ? 00:00:00 [rcu_tasks_rude_] root 12 2 0 Feb14 ? 00:00:00 [rcu_tasks_trace] root 13 2 0 Feb14 ? 00:00:32 [ksoftirqd/0] root 14 2 0 Feb14 ? 00:33:28 [rcu_sched] root 15 2 0 Feb14 ? 00:00:07 [migration/0] root 16 2 0 Feb14 ? 00:00:00 [idle_inject/0] root 18 2 0 Feb14 ? 00:00:00 [cpuhp/0] root 19 2 0 Feb14 ? 00:00:00 [cpuhp/1] root 20 2 0 Feb14 ? 00:00:00 [idle_inject/1] root 21 2 0 Feb14 ? 00:00:07 [migration/1] root 22 2 0 Feb14 ? 00:00:24 [ksoftirqd/1] root 24 2 0 Feb14 ? 00:00:00 [kworker/1:0H-events_highpri] root 25 2 0 Feb14 ? 00:00:00 [cpuhp/2] root 26 2 0 Feb14 ? 00:00:00 [idle_inject/2] root 27 2 0 Feb14 ? 00:00:07 [migration/2] root 28 2 0 Feb14 ? 00:00:24 [ksoftirqd/2] root 30 2 0 Feb14 ? 00:00:00 [kworker/2:0H-events_highpri] root 31 2 0 Feb14 ? 00:00:00 [cpuhp/3] root 32 2 0 Feb14 ? 00:00:00 [idle_inject/3] root 33 2 0 Feb14 ? 00:00:05 [migration/3] root 34 2 0 Feb14 ? 00:01:55 [ksoftirqd/3] root 36 2 0 Feb14 ? 00:00:00 [kworker/3:0H-events_highpri] root 37 2 0 Feb14 ? 00:00:00 [cpuhp/4] root 38 2 0 Feb14 ? 00:00:00 [idle_inject/4] root 39 2 0 Feb14 ? 00:00:07 [migration/4] root 40 2 0 Feb14 ? 00:00:31 [ksoftirqd/4] root 42 2 0 Feb14 ? 00:00:00 [kworker/4:0H-events_highpri] root 43 2 0 Feb14 ? 00:00:00 [cpuhp/5] root 44 2 0 Feb14 ? 00:00:00 [idle_inject/5] root 45 2 0 Feb14 ? 00:00:07 [migration/5] root 46 2 0 Feb14 ? 00:00:23 [ksoftirqd/5] root 48 2 0 Feb14 ? 00:00:00 [kworker/5:0H-events_highpri] root 49 2 0 Feb14 ? 00:00:00 [cpuhp/6] root 50 2 0 Feb14 ? 00:00:00 [idle_inject/6] root 51 2 0 Feb14 ? 00:00:06 [migration/6] root 52 2 0 Feb14 ? 00:00:24 [ksoftirqd/6] root 54 2 0 Feb14 ? 00:00:00 [kworker/6:0H-kblockd] root 55 2 0 Feb14 ? 00:00:00 [cpuhp/7] root 56 2 0 Feb14 ? 00:00:00 [idle_inject/7] root 57 2 0 Feb14 ? 00:00:06 [migration/7] root 58 2 0 Feb14 ? 00:00:26 [ksoftirqd/7] root 60 2 0 Feb14 ? 00:00:00 [kworker/7:0H-events_highpri] root 61 2 0 Feb14 ? 00:00:00 [kdevtmpfs] root 62 2 0 Feb14 ? 00:00:00 [inet_frag_wq] root 63 2 0 Feb14 ? 00:00:00 [kauditd] root 64 2 0 Feb14 ? 00:00:03 [khungtaskd] root 65 2 0 Feb14 ? 00:00:00 [oom_reaper] root 66 2 0 Feb14 ? 00:00:00 [writeback] root 67 2 0 Feb14 ? 00:06:25 [kcompactd0] root 68 2 0 Feb14 ? 00:00:00 [ksmd] root 69 2 0 Feb14 ? 00:00:00 [khugepaged] root 116 2 0 Feb14 ? 00:00:00 [kintegrityd] root 117 2 0 Feb14 ? 00:00:00 [kblockd] root 118 2 0 Feb14 ? 00:00:00 [blkcg_punt_bio] root 119 2 0 Feb14 ? 00:00:00 [tpm_dev_wq] root 120 2 0 Feb14 ? 00:00:00 [ata_sff] root 121 2 0 Feb14 ? 00:00:00 [md] root 122 2 0 Feb14 ? 00:00:00 [edac-poller] root 123 2 0 Feb14 ? 00:00:00 [devfreq_wq] root 124 2 0 Feb14 ? 00:00:00 [watchdogd] root 127 2 0 Feb14 ? 00:00:09 [kworker/0:1H-kblockd] root 129 2 0 Feb14 ? 00:00:45 [kswapd0] root 131 2 0 Feb14 ? 00:00:00 [ecryptfs-kthrea] root 133 2 0 Feb14 ? 00:00:00 [kthrotld] root 135 2 0 Feb14 ? 00:00:00 [acpi_thermal_pm] root 137 2 0 Feb14 ? 00:00:00 [scsi_eh_0] root 138 2 0 Feb14 ? 00:00:00 [scsi_tmf_0] root 139 2 0 Feb14 ? 00:00:00 [scsi_eh_1] root 140 2 0 Feb14 ? 00:00:00 [scsi_tmf_1] root 142 2 0 Feb14 ? 00:00:00 [vfio-irqfd-clea] root 143 2 0 Feb14 ? 00:00:00 [mld] root 144 2 0 Feb14 ? 00:00:13 [kworker/4:1H-kblockd] root 145 2 0 Feb14 ? 00:00:00 [ipv6_addrconf] root 149 2 0 Feb14 ? 00:00:14 [kworker/6:1H-kblockd] root 157 2 0 Feb14 ? 00:00:00 [kstrp] root 162 2 0 Feb14 ? 00:00:00 [zswap-shrink] root 163 2 0 Feb14 ? 00:00:00 [kworker/u17:0] root 168 2 0 Feb14 ? 00:00:00 [charger_manager] root 191 2 0 Feb14 ? 00:00:15 [kworker/5:1H-kblockd] root 212 2 0 Feb14 ? 00:00:14 [kworker/7:1H-kblockd] root 222 2 0 Feb14 ? 00:00:00 [cryptd] root 255 2 0 Feb14 ? 00:00:11 [kworker/1:1H-kblockd] root 259 2 0 Feb14 ? 00:00:11 [kworker/2:1H-kblockd] root 271 2 0 Feb14 ? 00:00:10 [kworker/3:1H-kblockd] root 304 2 0 Feb14 ? 00:00:00 [raid5wq] root 352 2 0 Feb14 ? 00:03:47 [jbd2/vda1-8] root 353 2 0 Feb14 ? 00:00:00 [ext4-rsv-conver] root 432 1 0 Feb14 ? 00:04:52 /lib/systemd/systemd-journald root 460 2 0 Feb14 ? 00:00:00 [kaluad] root 464 2 0 Feb14 ? 00:00:00 [kmpath_rdacd] root 466 2 0 Feb14 ? 00:00:00 [kmpathd] root 467 2 0 Feb14 ? 00:00:00 [kmpath_handlerd] root 471 1 0 Feb14 ? 00:00:06 /lib/systemd/systemd-udevd root 517 2 0 Feb14 ? 00:00:23 [jbd2/loop6-8] root 518 2 0 Feb14 ? 00:00:00 [ext4-rsv-conver] _rpc 643 1 0 Feb14 ? 00:00:04 /sbin/rpcbind -f -w systemd+ 650 1 0 Feb14 ? 00:00:06 /lib/systemd/systemd-timesyncd root 662 2 0 Feb14 ? 00:00:00 [rpciod] root 663 2 0 Feb14 ? 00:00:00 [xprtiod] systemd+ 744 1 0 Feb14 ? 00:00:26 /lib/systemd/systemd-networkd message+ 780 1 0 Feb14 ? 00:01:13 @dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only root 788 1 0 Feb14 ? 00:00:50 /usr/sbin/irqbalance --foreground root 791 1 0 Feb14 ? 00:00:00 /usr/bin/python3 /usr/bin/networkd-dispatcher --run-startup-triggers root 798 1 0 Feb14 ? 00:00:00 /usr/sbin/qemu-ga root 814 1 0 Feb14 ? 00:03:12 /usr/lib/snapd/snapd root 818 1 0 Feb14 ? 00:00:37 /lib/systemd/systemd-logind root 862 1 0 Feb14 ? 00:00:00 /usr/libexec/polkitd --no-debug root 938 1 0 Feb14 ? 00:06:44 cpsrvd (SSL) - waiting for connections root 975 1 0 Feb14 ? 00:00:24 /usr/sbin/cron -f -P daemon 1003 1 0 Feb14 ? 00:00:00 /usr/sbin/atd -f root 1029 1 0 Feb14 ? 00:01:26 sshd: /usr/sbin/sshd -D [listener] 1 of 10-100 startups root 1045 1 0 Feb14 ttyS0 00:00:00 /sbin/agetty -o -p -- \u --keep-baud 115200,57600,38400,9600 ttyS0 vt220 root 1060 1 0 Feb14 tty1 00:00:00 /sbin/agetty -o -p -- \u --noclear tty1 linux root 1293 1 0 Feb14 ? 00:05:59 cpdavd - accepting connections on: 2079, 2080, 2091, 2077, 2078 root 1295 1 0 Feb14 ? 00:02:39 cPhulkd - processor root 1296 1 0 Feb14 ? 00:00:55 dnsadmin - dormant mode root 1297 1 0 Feb14 ? 00:12:34 tailwatchd uuidd 1771 1 0 Feb14 ? 00:00:00 /usr/sbin/uuidd --socket-activation root 18300 1 0 Feb15 ? 00:02:34 /usr/sbin/httpd -k start root 109084 2 0 Feb15 ? 00:00:00 [dio/vda1] root 291843 1 0 Feb25 ? 00:01:57 /usr/local/cpanel/3rdparty/bin/clamd -F root 291939 1 0 Feb25 ? 00:00:14 php-fpm: master process (/usr/local/cpanel/etc/php-fpm.conf) root 291968 1 0 Feb25 ? 00:01:37 php-fpm: master process (/opt/cpanel/ea-php81/root/etc/php-fpm.conf) mysql 292094 1 1 Feb25 ? 00:41:20 /usr/sbin/mariadbd root 292158 1 0 Feb25 ? 00:00:19 /sbin/multipathd -d -s ollama 292204 1 0 Feb25 ? 00:00:16 /usr/local/bin/ollama serve root 292270 1 0 Feb25 ? 00:00:01 /usr/libexec/packagekitd named 292341 1 0 Feb25 ? 00:01:10 /usr/sbin/pdns_server --guardian=no --daemon=no --disable-syslog --log-timestamp=no --write-pid=no root 292468 1 0 Feb25 ? 00:00:21 sw-engine-fpm: master process (/etc/sw-engine/sw-engine-fpm.conf) wp-tool+ 292516 1 0 Feb25 ? 00:01:30 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script background-tasks-executor.php wp-tool+ 292556 1 0 Feb25 ? 00:00:05 /usr/bin/sw-engine /usr/local/cpanel/3rdparty/wp-toolkit/bin/run-script scheduled-tasks-executor.php root 322454 1 0 Feb17 ? 00:00:50 /usr/sbin/dovecot -F -c /etc/dovecot/dovecot.conf root 322455 322454 0 Feb17 ? 00:00:20 dovecot/anvil mailnull 323973 1 0 Feb17 ? 00:00:54 /usr/sbin/exim -ps -bd -q15m -oP /var/spool/exim/exim-daemon.pid root 395991 2 0 Feb25 ? 00:00:09 [kworker/7:1-mm_percpu_wq] root 410301 2 0 00:00 ? 00:00:06 [kworker/0:0-events] root 433130 2 0 02:06 ? 00:00:03 [kworker/3:1-cgwb_release] root 460036 1 0 04:01 ? 00:00:17 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --allowed-ips=127.0.0.1,::1 --max-children=5 --pidfile=/var/run/spamd.pid --listen=5 --listen=6 root 460172 460036 0 04:02 ? 00:00:50 spamd child root 487964 2 0 07:06 ? 00:00:01 [kworker/2:1-events] root 491474 2 0 07:22 ? 00:00:02 [kworker/1:0-mm_percpu_wq] root 506283 1 0 09:00 ? 00:00:00 /usr/bin/imunify-agent-proxy root 515258 2 0 10:06 ? 00:00:01 [kworker/5:2-events] root 522942 2 0 11:06 ? 00:00:01 [kworker/6:2-ata_sff] root 524112 460036 0 11:15 ? 00:00:01 spamd child root 526299 2 0 11:30 ? 00:00:00 [kworker/7:2] root 530160 2 0 12:00 ? 00:00:00 [kworker/0:2-events] root 530197 2 0 12:00 ? 00:00:00 [kworker/2:0] root 530913 2 0 12:06 ? 00:00:00 [kworker/1:1] root 537808 2 0 13:00 ? 00:00:00 [kworker/5:0-mm_percpu_wq] root 537955 2 0 13:01 ? 00:00:01 [kworker/u16:5-flush-7:6] root 538615 2 0 13:06 ? 00:00:00 [kworker/4:0-mm_percpu_wq] root 541692 18300 0 13:25 ? 00:00:00 /usr/local/cpanel/bin/splitlogs --dir=/etc/apache2/logs/domlogs --main=lax2-dan-kepler.5linq.com --suffix=-bytes_log root 541693 18300 0 13:25 ? 00:00:00 /usr/local/cpanel/bin/splitlogs --main=apache-traffic.log --mainout=/var/log/cpanel-server-traffic/web/traffic-apache.log root 541694 18300 0 13:25 ? 00:00:00 /usr/local/cpanel/bin/splitlogs --dir=/etc/apache2/logs/domlogs --main=lax2-dan-kepler.5linq.com --mainout=/etc/apache2/logs/access_log dovenull 541695 322454 0 13:25 ? 00:00:00 dovecot/imap-login dovenull 541696 322454 0 13:25 ? 00:00:00 dovecot/managesieve-login dovenull 541697 322454 0 13:25 ? 00:00:00 dovecot/pop3-login root 541698 322454 0 13:25 ? 00:00:00 dovecot/log dovenull 541699 322454 0 13:25 ? 00:00:00 dovecot/imap-login dovenull 541700 322454 0 13:25 ? 00:00:00 dovecot/managesieve-login dovenull 541701 322454 0 13:25 ? 00:00:00 dovecot/pop3-login dovecot 541702 322454 0 13:25 ? 00:00:00 dovecot/stats root 541703 322454 0 13:25 ? 00:00:00 dovecot/config dovecot 541704 322454 0 13:25 ? 00:00:00 dovecot/auth root 541705 18300 0 13:25 ? 00:00:00 /usr/local/cpanel/3rdparty/bin/perl /usr/local/cpanel/bin/leechprotect dovecot 541830 322454 0 13:26 ? 00:00:00 dovecot/imap-hibernate root 542269 2 0 13:30 ? 00:00:00 [kworker/6:0] nirvana+ 543202 322454 0 13:36 ? 00:00:00 dovecot/imap nirvana+ 543203 322454 0 13:36 ? 00:00:00 dovecot/imap root 543261 2 0 13:37 ? 00:00:00 [kworker/u16:3-events_power_efficient] root 545631 2 0 13:57 ? 00:00:00 [kworker/u16:4-flush-7:6] root 546103 2 0 14:00 ? 00:00:00 [kworker/4:1-events] nobody 546477 18300 0 14:02 ? 00:00:01 /usr/sbin/httpd -k start root 546873 2 0 14:05 ? 00:00:00 [kworker/u16:1-events_power_efficient] root 546939 2 0 14:06 ? 00:00:00 [kworker/3:0-mm_percpu_wq] linq 547762 18300 0 14:15 ? 00:00:01 /usr/sbin/httpd -k start root 548006 2 0 14:16 ? 00:00:00 [kworker/u16:0-events_power_efficient] nobody 548425 18300 0 14:20 ? 00:00:00 /usr/sbin/httpd -k start nobody 548709 18300 0 14:22 ? 00:00:00 /usr/sbin/httpd -k start nobody 548782 18300 0 14:23 ? 00:00:00 /usr/sbin/httpd -k start nobody 548783 18300 0 14:23 ? 00:00:00 /usr/sbin/httpd -k start nobody 548887 18300 0 14:24 ? 00:00:01 /usr/sbin/httpd -k start nobody 548889 18300 0 14:24 ? 00:00:00 /usr/sbin/httpd -k start nobody 549024 18300 0 14:25 ? 00:00:00 /usr/sbin/httpd -k start nobody 549025 18300 0 14:25 ? 00:00:00 /usr/sbin/httpd -k start nobody 549186 18300 0 14:26 ? 00:00:00 /usr/sbin/httpd -k start root 549278 2 0 14:27 ? 00:00:00 [kworker/u16:2-flush-252:0] nobody 549701 18300 0 14:31 ? 00:00:00 /usr/sbin/httpd -k start root 549778 322454 0 14:31 ? 00:00:00 dovecot/auth -w root 549870 2 0 14:31 ? 00:00:00 [kworker/u16:6-flush-7:6] mailnull 549886 323973 0 14:31 ? 00:00:00 /usr/sbin/exim -ps -bd -q15m -oP /var/spool/exim/exim-daemon.pid root 549893 1029 0 14:31 ? 00:00:00 sshd: [accepted] root 549926 322454 0 14:32 ? 00:00:00 dovecot/auth -w root 549929 322454 0 14:32 ? 00:00:00 dovecot/auth -w easymar+ 549931 322454 0 14:32 ? 00:00:00 dovecot/imap easymar+ 549934 322454 0 14:32 ? 00:00:00 dovecot/imap easymar+ 549937 322454 0 14:32 ? 00:00:00 dovecot/imap easymar+ 549938 322454 0 14:32 ? 00:00:00 dovecot/imap easymar+ 549970 322454 0 14:32 ? 00:00:00 dovecot/quota-status -p postfix linq 549976 291968 21 14:32 ? 00:00:02 php-fpm: pool 5linq_com root 549983 938 0 14:32 ? 00:00:00 [cpsrvd (SSL) - ] linq 549984 291968 18 14:32 ? 00:00:01 php-fpm: pool 5linq_com traffire 549989 291968 0 14:32 ? 00:00:00 php-fpm: pool adserver_traffire_com maxmedia 549990 291968 3 14:32 ? 00:00:00 php-fpm: pool maxmediamix_com linq 549992 291968 15 14:32 ? 00:00:00 php-fpm: pool 5linq_com wp-tool+ 549996 292468 0 14:32 ? 00:00:00 sw-engine-fpm: pool wordpress-toolkit linq 549997 549984 0 14:32 ? 00:00:00 sh -c ps -ef linq 549998 549997 0 14:32 ? 00:00:00 ps -ef syslog 657707 1 0 Feb19 ? 00:00:51 /usr/sbin/rsyslogd -n -iNONE root 3824788 1 0 Feb24 ? 00:00:17 queueprocd - waiting up to 60s to process a task root 3827139 1 0 Feb24 ? 00:01:39 /usr/sbin/nscd root 3827335 1 0 Feb24 ? 00:00:02 cpanellogd - sleeping for logs cpanelc+ 3827340 1 0 Feb24 ? 00:10:57 /usr/local/cpanel/3rdparty/sbin/p0f -i any -u cpanelconnecttrack -d -s /var/cpanel/userhomes/cpanelconnecttrack/p0f.socket less 400 and not dst port 80 and not dst port 443 and tcp[13] & 8==0 root 3827341 1295 0 Feb24 ? 00:00:55 cPhulkd - dbprocessor mailman 3827405 1 0 Feb24 ? 00:00:00 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/mailmanctl -s start mailman 3827431 3827405 0 Feb24 ? 00:00:40 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=ArchRunner:0:1 -s mailman 3827432 3827405 0 Feb24 ? 00:00:41 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=BounceRunner:0:2 -s mailman 3827433 3827405 0 Feb24 ? 00:00:40 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=BounceRunner:1:2 -s mailman 3827434 3827405 0 Feb24 ? 00:00:41 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=CommandRunner:0:1 -s mailman 3827435 3827405 0 Feb24 ? 00:00:40 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=IncomingRunner:0:4 -s mailman 3827436 3827405 0 Feb24 ? 00:00:41 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=IncomingRunner:1:4 -s mailman 3827437 3827405 0 Feb24 ? 00:00:40 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=IncomingRunner:2:4 -s mailman 3827438 3827405 0 Feb24 ? 00:00:41 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=IncomingRunner:3:4 -s mailman 3827441 3827405 0 Feb24 ? 00:00:41 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=NewsRunner:0:1 -s mailman 3827442 3827405 0 Feb24 ? 00:00:41 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:0:8 -s mailman 3827443 3827405 0 Feb24 ? 00:00:41 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:1:8 -s mailman 3827444 3827405 0 Feb24 ? 00:00:42 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:2:8 -s mailman 3827445 3827405 0 Feb24 ? 00:00:41 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:3:8 -s mailman 3827446 3827405 0 Feb24 ? 00:00:41 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:4:8 -s mailman 3827447 3827405 0 Feb24 ? 00:00:41 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:5:8 -s mailman 3827449 3827405 0 Feb24 ? 00:00:41 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:6:8 -s mailman 3827450 3827405 0 Feb24 ? 00:00:41 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=OutgoingRunner:7:8 -s mailman 3827451 3827405 0 Feb24 ? 00:00:41 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=VirginRunner:0:1 -s mailman 3827452 3827405 0 Feb24 ? 00:00:21 /usr/bin/python3 /usr/local/cpanel/3rdparty/mailman/bin/qrunner --runner=RetryRunner:0:1 -s