Hi,
In last two days my sites got really slow to load and when i checked the ls error log i see this
2024-07-20 12:46:40.685760 [INFO] [46363] [194.163.128.174:57342#qrs.ircs.org.iq] HttpExtConnector state: 8, request body sent: 0, response body size: -2, response body sent:0, left in buffer: 0, attempts: 0.
2024-07-20 12:51:30.419199 [INFO] [46365] [185.147.102.116:47462-Q:C764F153771056A1-472#qrs.ircs.org.iq] Connection idle time too long: 301 while in state: 6 watching for event: 270336, close!
2024-07-20 12:51:30.419243 [INFO] [46365] [185.147.102.116:47462-Q:C764F153771056A1-472] Content len: 84, request line: ‘POST /wp-admin/admin-ajax.php HTTP/1.1’
2024-07-20 12:51:30.419249 [INFO] [46365] [185.147.102.116:47462-Q:C764F153771056A1-472#qrs.ircs.org.iq] HttpExtConnector state: 8, request body sent: 84, response body size: -2, response body sent:0, left in buffer: 0, attempts: 0.
2024-07-20 12:54:37.124094 [INFO] [46366] [194.163.128.174:37530#qrs.ircs.org.iq] Connection idle time too long: 301 while in state: 6 watching for event: 0, close!
2024-07-20 12:54:37.124137 [INFO] [46366] [194.163.128.174:37530] Content len: 0, request line: ‘POST /wp-admin/admin-ajax.php?action=async_litespeed&nonce=afcad1176e&litespeed_type=imgoptm HTTP/1.1’
2024-07-20 12:54:37.124149 [INFO] [46366] [194.163.128.174:37530#qrs.ircs.org.iq] HttpExtConnector state: 8, request body sent: 0, response body size: -2, response body sent:0, left in buffer: 0, attempts: 0.
2024-07-20 12:56:59.483928 [INFO] [46364] [65.20.137.188:63677-Q:075E15B884177154-4#qrs.ircs.org.iq] Connection idle time too long: 301 while in state: 6 watching for event: 270336, close!
2024-07-20 12:56:59.483974 [INFO] [46364] [65.20.137.188:63677-Q:075E15B884177154-4] Content len: 0, request line: ‘GET / HTTP/1.1’
2024-07-20 12:56:59.483982 [INFO] [46364] [65.20.137.188:63677-Q:075E15B884177154-4#qrs.ircs.org.iq] HttpExtConnector state: 8, request body sent: 0, response body size: -2, response body sent:0, left in buffer: 0, attempts: 0.
2024-07-20 12:59:00.006309 [INFO] [46364] [194.163.128.174:36668#qrs.ircs.org.iq] Connection idle time too long: 301 while in state: 6 watching for event: 0, close!
2024-07-20 12:59:00.006325 [INFO] [46364] [194.163.128.174:36668] Content len: 0, request line: ‘POST /wp-admin/admin-ajax.php?action=async_litespeed&nonce=afcad1176e&litespeed_type=imgoptm HTTP/1.1’
2024-07-20 12:59:00.006330 [INFO] [46364] [194.163.128.174:36668#qrs.ircs.org.iq] HttpExtConnector state: 8, request body sent: 0, response body size: -2, response body sent:0, left in buffer: 0, attempts: 0.
2024-07-20 13:02:00.678743 [INFO] [46364] [65.20.137.188:63677-Q:075E15B884177154-8#qrs.ircs.org.iq] Connection idle time too long: 301 while in state: 6 watching for event: 270336, close!
2024-07-20 13:02:00.678845 [INFO] [46364] [65.20.137.188:63677-Q:075E15B884177154-8] Content len: 0, request line: ‘GET /favicon.ico HTTP/1.1’
2024-07-20 13:02:00.678856 [INFO] [46364] [65.20.137.188:63677-Q:075E15B884177154-8] Redirect: #1, URL: /index.php
2024-07-20 13:02:00.678862 [INFO] [46364] [65.20.137.188:63677-Q:075E15B884177154-8#qrs.ircs.org.iq] HttpExtConnector state: 8, request body sent: 0, response body size: -2, response body sent:0, left in buffer: 0, attempts: 0.
2024-07-20 13:12:42.640453 [INFO] [46365] [194.163.128.174:43296#qrs.ircs.org.iq] Connection idle time too long: 301 while in state: 6 watching for event: 0, close!
2024-07-20 13:12:42.641040 [INFO] [46365] [194.163.128.174:43296] Content len: 443, request line: ‘POST /wp-json/bit-integrations/v1/callback/01643cee-2018-4afe-84a5-685867f21007 HTTP/1.1’
2024-07-20 13:12:42.641048 [INFO] [46365] [194.163.128.174:43296] Redirect: #1, URL: /index.php
2024-07-20 13:12:42.641054 [INFO] [46365] [194.163.128.174:43296#qrs.ircs.org.iq] HttpExtConnector state: 8, request body sent: 443, response body size: -2, response body sent:0, left in buffer: 0, attempts: 0.
2024-07-20 13:20:11.036395 [INFO] [46366] [194.163.128.174:38188#qrs.ircs.org.iq] Connection idle time too long: 301 while in state: 6 watching for event: 0, close!
2024-07-20 13:20:11.036423 [INFO] [46366] [194.163.128.174:38188] Content len: 0, request line: ‘POST /wp-admin/admin-ajax.php?action=async_litespeed&nonce=afcad1176e&litespeed_type=imgoptm HTTP/1.1’
2024-07-20 13:20:11.036429 [INFO] [46366] [194.163.128.174:38188#qrs.ircs.org.iq] HttpExtConnector state: 8, request body sent: 0, response body size: -2, response body sent:0, left in buffer: 0, attempts: 0.
2024-07-20 13:23:08.052233 [NOTICE] [46363] [LocalWorker::workerExec] VHost:_AdminVHost suExec check uid 998 gid 65534 setuidmode 2.
2024-07-20 13:23:08.052270 [INFO] [46363] [LocalWorker::workerExec] VHost:_AdminVHost suExec check uid 998 gid 65534 setuidmode 2.
2024-07-20 13:23:08.052504 [NOTICE] [46363] [LocalWorker::workerExec] Config[AdminPHP]: suExec uid -1 gid -1 cmd /usr/local/lsws/admin/fcgi-bin/admin_php -c …/conf/php.ini, final uid 998 gid 65534, flags: 0.
2024-07-20 13:23:08.054407 [NOTICE] [46363] [AdminPHP] add child process pid: 114564
2024-07-20 13:23:39.053205 [NOTICE] [46363] sendKillCmdToWatchdog: ‘extappkill:114564:-3:0’.
2024-07-20 13:23:39.409462 [NOTICE] [46357] Cmd from child: [extappkill:114564:-3:0]
2024-07-20 13:23:39.409891 [INFO] [46357] Failed to get process [114564] start time, not running, skip killing.
2024-07-20 13:26:12.988460 [INFO] [46366] [194.163.128.174:41284#qrs.ircs.org.iq] Connection idle time too long: 301 while in state: 6 watching for event: 0, close!
2024-07-20 13:26:12.988505 [INFO] [46366] [194.163.128.174:41284] Content len: 430, request line: ‘POST /wp-json/bit-integrations/v1/callback/01643cee-2018-4afe-84a5-685867f21007 HTTP/1.1’
2024-07-20 13:26:12.988511 [INFO] [46366] [194.163.128.174:41284] Redirect: #1, URL: /index.php
2024-07-20 13:26:12.988517 [INFO] [46366] [194.163.128.174:41284#qrs.ircs.org.iq] HttpExtConnector state: 8, request body sent: 430, response body size: -2, response body sent:0, left in buffer: 0, attempts: 0.
2024-07-20 13:27:05.144648 [INFO] [46363] [194.163.128.174:42790#qrs.ircs.org.iq] Connection idle time too long: 301 while in state: 6 watching for event: 0, close!
2024-07-20 13:27:05.144689 [INFO] [46363] [194.163.128.174:42790] Content len: 0, request line: ‘POST /wp-admin/admin-ajax.php?action=async_litespeed&nonce=afcad1176e&litespeed_type=imgoptm HTTP/1.1’
2024-07-20 13:27:05.144695 [INFO] [46363] [194.163.128.174:42790#qrs.ircs.org.iq] HttpExtConnector state: 8, request body sent: 0, response body size: -2, response body sent:0, left in buffer: 0, attempts: 0.
2024-07-20 13:35:02.769774 [INFO] [46363] [142.93.129.190:54026#qrs.ircs.org.iq] [Module:mod_security] ModSecurity: Warning. Matched "Operator PmFromFile' with parameter restricted-files.data’ against variable REQUEST_FILENAME' (Value: /.DS_Store’ ) [file “/usr/local/lsws/conf/modsec/owasp-modsecurity-crs-3.0-master/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf”] [line “105”] [id “930130”] [rev “”] [msg “Restricted File Access Attempt”] [data “Matched Data: /.DS_Store found within REQUEST_FILENAME: /.ds_store”] [severity “2”] [ver “OWASP_CRS/3.3.2”] [maturity “0”] [accuracy “0”] [tag “application-multi”] [tag “language-multi”] [tag “platform-multi”] [tag “attack-lfi”] [tag “paranoia-level/1”] [tag “OWASP_CRS”] [tag “capec/1000/255/153/126”] [tag “PCI/6.5.4”] [hostname “qrs.ircs.org.iq”] [uri “/.DS_Store”] [unique_id “172147530248.498687”] [ref “o0,10v4,10t:utf8toUnicode,t:urlDecodeUni,t:normalizePathWin,t:lowercase”]
2024-07-20 13:35:02.773362 [INFO] [46363] [142.93.129.190:54026#qrs.ircs.org.iq] [Module:mod_security]Intervention status code triggered: 403
2024-07-20 13:35:02.773398 [INFO] [46363] [142.93.129.190:54026#qrs.ircs.org.iq] [Module:mod_security]Log Message: [client 142.93.129.190] ModSecurity: Access denied with code 403 (phase 2). Matched "Operator Ge' with parameter 5’ against variable TX:ANOMALY_SCORE' (Value: 5’ ) [file “/usr/local/lsws/conf/modsec/owasp-modsecurity-crs-3.0-master/rules/REQUEST-949-BLOCKING-EVALUATION.conf”] [line “80”] [id “949110”] [rev “”] [msg “Inbound Anomaly Score Exceeded (Total Score: 5)”] [data “”] [severity “2”] [ver “OWASP_CRS/3.3.2”] [maturity “0”] [accuracy “0”] [tag “application-multi”] [tag “language-multi”] [tag “platform-multi”] [tag “attack-generic”] [hostname “qrs.ircs.org.iq”] [uri “/.DS_Store”] [unique_id “172147530248.498687”] [ref “”]
2024-07-20 13:35:02.864778 [INFO] [46365] [142.93.129.190:54042#qrs.ircs.org.iq] [Module:mod_security] ModSecurity: Warning. Matched "Operator PmFromFile' with parameter restricted-files.data’ against variable REQUEST_FILENAME' (Value: /.env’ ) [file “/usr/local/lsws/conf/modsec/owasp-modsecurity-crs-3.0-master/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf”] [line “105”] [id “930130”] [rev “”] [msg “Restricted File Access Attempt”] [data “Matched Data: /.env found within REQUEST_FILENAME: /.env”] [severity “2”] [ver “OWASP_CRS/3.3.2”] [maturity “0”] [accuracy “0”] [tag “application-multi”] [tag “language-multi”] [tag “platform-multi”] [tag “attack-lfi”] [tag “paranoia-level/1”] [tag “OWASP_CRS”] [tag “capec/1000/255/153/126”] [tag “PCI/6.5.4”] [hostname “qrs.ircs.org.iq”] [uri “/.env”] [unique_id “17214753029.754803”] [ref “o0,5v4,5t:utf8toUnicode,t:urlDecodeUni,t:normalizePathWin,t:lowercase”]
2024-07-20 13:35:02.865845 [INFO] [46365] [142.93.129.190:54042#qrs.ircs.org.iq] [Module:mod_security]Intervention status code triggered: 403
2024-07-20 13:35:02.865867 [INFO] [46365] [142.93.129.190:54042#qrs.ircs.org.iq] [Module:mod_security]Log Message: [client 142.93.129.190] ModSecurity: Access denied with code 403 (phase 2). Matched "Operator Ge' with parameter 5’ against variable TX:ANOMALY_SCORE' (Value: 5’ ) [file “/usr/local/lsws/conf/modsec/owasp-modsecurity-crs-3.0-master/rules/REQUEST-949-BLOCKING-EVALUATION.conf”] [line “80”] [id “949110”] [rev “”] [msg “Inbound Anomaly Score Exceeded (Total Score: 5)”] [data “”] [severity “2”] [ver “OWASP_CRS/3.3.2”] [maturity “0”] [accuracy “0”] [tag “application-multi”] [tag “language-multi”] [tag “platform-multi”] [tag “attack-generic”] [hostname “qrs.ircs.org.iq”] [uri “/.env”] [unique_id “17214753029.754803”] [ref “”]
2024-07-20 13:35:02.932524 [INFO] [46366] [142.93.129.190:54044#qrs.ircs.org.iq] [Module:mod_security] ModSecurity: Warning. Matched "Operator PmFromFile' with parameter restricted-files.data’ against variable REQUEST_FILENAME' (Value: /.git/config’ ) [file “/usr/local/lsws/conf/modsec/owasp-modsecurity-crs-3.0-master/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf”] [line “105”] [id “930130”] [rev “”] [msg “Restricted File Access Attempt”] [data “Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config”] [severity “2”] [ver “OWASP_CRS/3.3.2”] [maturity “0”] [accuracy “0”] [tag “application-multi”] [tag “language-multi”] [tag “platform-multi”] [tag “attack-lfi”] [tag “paranoia-level/1”] [tag “OWASP_CRS”] [tag “capec/1000/255/153/126”] [tag “PCI/6.5.4”] [hostname “qrs.ircs.org.iq”] [uri “/.git/config”] [unique_id “172147530297.554321”] [ref “o0,6v4,12t:utf8toUnicode,t:urlDecodeUni,t:normalizePathWin,t:lowercase”]
2024-07-20 13:35:02.933071 [INFO] [46366] [142.93.129.190:54044#qrs.ircs.org.iq] [Module:mod_security]Intervention status code triggered: 403
2024-07-20 13:35:02.933089 [INFO] [46366] [142.93.129.190:54044#qrs.ircs.org.iq] [Module:mod_security]Log Message: [client 142.93.129.190] ModSecurity: Access denied with code 403 (phase 2). Matched "Operator Ge' with parameter 5’ against variable TX:ANOMALY_SCORE' (Value: 5’ ) [file “/usr/local/lsws/conf/modsec/owasp-modsecurity-crs-3.0-master/rules/REQUEST-949-BLOCKING-EVALUATION.conf”] [line “80”] [id “949110”] [rev “”] [msg “Inbound Anomaly Score Exceeded (Total Score: 5)”] [data “”] [severity “2”] [ver “OWASP_CRS/3.3.2”] [maturity “0”] [accuracy “0”] [tag “application-multi”] [tag “language-multi”] [tag “platform-multi”] [tag “attack-generic”] [hostname “qrs.ircs.org.iq”] [uri “/.git/config”] [unique_id “172147530297.554321”] [ref “”]
2024-07-20 13:35:46.696998 [INFO] [46366] [185.196.9.227:41188#qrs.ircs.org.iq] [Module:mod_security] ModSecurity: Warning. Matched "Operator PmFromFile' with parameter restricted-files.data’ against variable REQUEST_FILENAME' (Value: /.git/config’ ) [file “/usr/local/lsws/conf/modsec/owasp-modsecurity-crs-3.0-master/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf”] [line “105”] [id “930130”] [rev “”] [msg “Restricted File Access Attempt”] [data “Matched Data: /.git/ found within REQUEST_FILENAME: /.git/config”] [severity “2”] [ver “OWASP_CRS/3.3.2”] [maturity “0”] [accuracy “0”] [tag “application-multi”] [tag “language-multi”] [tag “platform-multi”] [tag “attack-lfi”] [tag “paranoia-level/1”] [tag “OWASP_CRS”] [tag “capec/1000/255/153/126”] [tag “PCI/6.5.4”] [hostname “qrs.ircs.org.iq”] [uri “/.git/config”] [unique_id “172147534630.034337”] [ref “o0,6v4,12t:utf8toUnicode,t:urlDecodeUni,t:normalizePathWin,t:lowercase”]
2024-07-20 13:35:46.697534 [INFO] [46366] [185.196.9.227:41188#qrs.ircs.org.iq] [Module:mod_security]Intervention status code triggered: 403
2024-07-20 13:35:46.697547 [INFO] [46366] [185.196.9.227:41188#qrs.ircs.org.iq] [Module:mod_security]Log Message: [client 185.196.9.227] ModSecurity: Access denied with code 403 (phase 2). Matched "Operator Ge' with parameter 5’ against variable TX:ANOMALY_SCORE' (Value: 5’ ) [file “/usr/local/lsws/conf/modsec/owasp-modsecurity-crs-3.0-master/rules/REQUEST-949-BLOCKING-EVALUATION.conf”] [line “80”] [id “949110”] [rev “”] [msg “Inbound Anomaly Score Exceeded (Total Score: 5)”] [data “”] [severity “2”] [ver “OWASP_CRS/3.3.2”] [maturity “0”] [accuracy “0”] [tag “application-multi”] [tag “language-multi”] [tag “platform-multi”] [tag “attack-generic”] [hostname “qrs.ircs.org.iq”] [uri “/.git/config”] [unique_id “172147534630.034337”] [ref “”]
Any help will be appreciated