Hello,
from while I migrated to a fresh installation Cyberpanel (Ubuntu 22), WP cron not work and I don´t know why.
In a CSF log have “suspicious process”:
Aug 6 23:32:03 ubuntu lfd[314853]: Suspicious Process PID:314825 PPID:311779 User:nabna2000 Uptime:63 secs EXE:/usr/local/lsws/lsphp74/bin/lsphp CMD:lsphp
Aug 6 23:37:03 ubuntu lfd[314940]: Suspicious Process PID:314910 PPID:311779 User:nabna2000 Uptime:78 secs EXE:/usr/local/lsws/lsphp74/bin/lsphp CMD:lsphp:ysite.com/public_html/wp-admin/admin.php
Aug 6 23:37:03 ubuntu lfd[314940]: Suspicious Process PID:314914 PPID:311779 User:nabna2000 Uptime:63 secs EXE:/usr/local/lsws/lsphp74/bin/lsphp CMD:lsphp
Aug 6 23:40:04 ubuntu lfd[315064]: Suspicious Process PID:314972 PPID:311779 User:nabna2000 Uptime:84 secs EXE:/usr/local/lsws/lsphp74/bin/lsphp CMD:lsphp:ysite.com/public_html/wp-admin/admin.php
Aug 6 23:42:04 ubuntu lfd[315098]: Suspicious Process PID:315077 PPID:311779 User:nabna2000 Uptime:63 secs EXE:/usr/local/lsws/lsphp74/bin/lsphp CMD:lsphp:/home/mysite.com/public_html/wp-load.php
Aug 6 23:46:04 ubuntu lfd[315173]: Suspicious Process PID:315147 PPID:311779 User:nabna2000 Uptime:77 secs EXE:/usr/local/lsws/lsphp74/bin/lsphp CMD:lsphp:ysite.com/public_html/wp-admin/admin.php
Aug 6 23:47:04 ubuntu lfd[315194]: Suspicious Process PID:315167 PPID:311779 User:nabna2000 Uptime:63 secs EXE:/usr/local/lsws/lsphp74/bin/lsphp CMD:lsphp:/home/mysite.com/public_html/wp-load.php
Aug 6 23:48:04 ubuntu lfd[315213]: Suspicious Process PID:315179 PPID:311779 User:nabna2000 Uptime:104 secs EXE:/usr/local/lsws/lsphp74/bin/lsphp CMD:lsphp:ysite.com/public_html/wp-admin/admin.php
Aug 6 23:52:04 ubuntu lfd[315287]: Suspicious Process PID:315260 PPID:311779 User:nabna2000 Uptime:63 secs EXE:/usr/local/lsws/lsphp74/bin/lsphp CMD:lsphp:/home/mysite.com/public_html/wp-load.php
Aug 6 23:54:04 ubuntu lfd[315319]: Suspicious Process PID:315296 PPID:311779 User:nabna2000 Uptime:81 secs EXE:/usr/local/lsws/lsphp74/bin/lsphp CMD:lsphp:ysite.com/public_html/wp-admin/admin.php
Aug 6 23:57:04 ubuntu lfd[315384]: Suspicious Process PID:315361 PPID:311779 User:nabna2000 Uptime:63 secs EXE:/usr/local/lsws/lsphp74/bin/lsphp CMD:lsphp:/home/mysite.com/public_html/wp-load.php
Aug 6 23:58:04 ubuntu lfd[315399]: Suspicious Process PID:315377 PPID:311779 User:nabna2000 Uptime:67 secs EXE:/usr/local/lsws/lsphp74/bin/lsphp CMD:lsphp:ysite.com/public_html/wp-admin/admin.php
Aug 7 00:00:03 ubuntu lfd[277815]: Main Process: TERM
Aug 7 00:00:03 ubuntu lfd[277815]: daemon stopped
Aug 7 00:00:03 ubuntu lfd[315524]: daemon started on ubuntu - csf v14.19 (CyberPanel)
Aug 7 00:00:03 ubuntu lfd[315524]: WARNING Unable to send email reports - [/usr/sbin/sendmail] not found
Aug 7 00:00:03 ubuntu lfd[315524]: LF_APACHE_ERRPORT: Set to [2]
Aug 7 00:00:03 ubuntu lfd[315524]: Restricting syslog/rsyslog socket acccess to group [mysyslog]…
Aug 7 00:00:03 ubuntu lfd[315524]: CSF Tracking…
Aug 7 00:00:03 ubuntu lfd[315524]: IPv6 Enabled…
Aug 7 00:00:03 ubuntu lfd[315524]: Country Code Lookups…
Aug 7 00:00:03 ubuntu lfd[315524]: System Integrity Tracking…
Aug 7 00:00:03 ubuntu lfd[315524]: Exploit Tracking…
Aug 7 00:00:03 ubuntu lfd[315524]: Directory Watching…
Aug 7 00:00:03 ubuntu lfd[315524]: Temp to Perm Block Tracking…
Aug 7 00:00:03 ubuntu lfd[315524]: Process Tracking…
Aug 7 00:00:03 ubuntu lfd[315524]: Account Tracking…
Aug 7 00:00:03 ubuntu lfd[315524]: SU Tracking…
Aug 7 00:00:03 ubuntu lfd[315524]: Console Tracking…
Aug 7 00:00:03 ubuntu lfd[315524]: Watching /var/log/customlog…
Aug 7 00:00:03 ubuntu lfd[315524]: Watching /var/log/kern.log…
Aug 7 00:00:03 ubuntu lfd[315524]: Watching /var/log/messages…
Aug 7 00:00:03 ubuntu lfd[315524]: Watching /usr/local/lsws/logs/error.log…
Aug 7 00:00:03 ubuntu lfd[315524]: Watching /var/log/syslog…
Aug 7 00:00:03 ubuntu lfd[315524]: Watching /var/log/auth.log…
Aug 7 00:00:03 ubuntu lfd[315524]: Watching /var/log/mail.log…
Aug 7 00:00:03 ubuntu lfd[315524]: Watching /usr/local/lsws/logs/auditmodsec.log…
Aug 7 00:00:03 ubuntu lfd[315534]: Suspicious Process PID:636 PPID:636 User:redis Uptime:983242 secs EXE:/usr/bin/redis-check-rdb CMD:/usr/bin/redis-server 127.0.0.1:6379
Aug 7 00:00:03 ubuntu lfd[315534]: Suspicious Process PID:315418 PPID:311779 User:nabna2000 Uptime:62 secs EXE:/usr/local/lsws/lsphp74/bin/lsphp CMD:lsphp:/home/mysite.com/public_html/wp-load.php
Aug 7 00:01:03 ubuntu lfd[315561]: Suspicious Process PID:315439 PPID:311779 User:nabna2000 Uptime:65 secs EXE:/usr/local/lsws/lsphp74/bin/lsphp CMD:lsphp:ysite.com/public_html/wp-admin/admin.php
Aug 7 00:02:03 ubuntu lfd[315588]: Suspicious Process PID:315558 PPID:311779 User:nabna2000 Uptime:62 secs EXE:/usr/local/lsws/lsphp74/bin/lsphp CMD:lsphp:/home/mysite.com/public_html/wp-load.php
Aug 7 00:07:04 ubuntu lfd[315961]: Suspicious Process PID:315656 PPID:311779 User:nabna2000 Uptime:62 secs EXE:/usr/local/lsws/lsphp74/bin/lsphp CMD:lsphp:/home/mysite.com/public_html/wp-load.php
Aug 7 00:10:04 ubuntu lfd[316082]: Suspicious Process PID:315994 PPID:311779 User:nabna2000 Uptime:76 secs EXE:/usr/local/lsws/lsphp74/bin/lsphp CMD:lsphp:/home/mysite.com/public_html/index.php
Aug 7 00:22:04 ubuntu lfd[316325]: Suspicious Process PID:316296 PPID:316276 User:nabna2000 Uptime:63 secs EXE:/usr/local/lsws/lsphp74/bin/lsphp CMD:lsphp:/home/mysite.com/public_html/wp-load.php
Aug 7 00:27:04 ubuntu lfd[316425]: Suspicious Process PID:316396 PPID:316386 User:nabna2000 Uptime:63 secs EXE:/usr/local/lsws/lsphp74/bin/lsphp CMD:lsphp:/home/mysite.com/public_html/wp-load.php
Aug 7 00:47:05 ubuntu lfd[316859]: Suspicious Process PID:316841 PPID:316807 User:nabna2000 Uptime:64 secs EXE:/usr/local/lsws/lsphp74/bin/lsphp CMD:lsphp:/home/mysite.com/public_html/wp-load.php
Aug 7 00:52:06 ubuntu lfd[316955]: Suspicious Process PID:316924 PPID:316916 User:nabna2000 Uptime:65 secs EXE:/usr/local/lsws/lsphp74/bin/lsphp CMD:lsphp
Aug 7 01:00:06 ubuntu lfd[317140]: Suspicious Process PID:636 PPID:636 User:redis Uptime:986844 secs EXE:/usr/bin/redis-check-rdb CMD:/usr/bin/redis-server 127.0.0.1:6379
Aug 7 01:07:06 ubuntu lfd[317274]: Suspicious Process PID:317247 PPID:316916 User:nabna2000 Uptime:65 secs EXE:/usr/local/lsws/lsphp74/bin/lsphp CMD:lsphp:/home/mysite.com/public_html/wp-load.php
Aug 7 01:12:06 ubuntu lfd[317435]: Suspicious Process PID:317404 PPID:317403 User:nabna2000 Uptime:65 secs EXE:/usr/local/lsws/lsphp74/bin/lsphp CMD:lsphp:/home/mysite.com/public_html/wp-load.php
Aug 7 01:22:07 ubuntu lfd[317608]: Suspicious Process PID:317582 PPID:317403 User:nabna2000 Uptime:65 secs EXE:/usr/local/lsws/lsphp74/bin/lsphp CMD:lsphp
Aug 7 01:27:07 ubuntu lfd[317728]: Suspicious Process PID:317697 PPID:317642 User:nabna2000 Uptime:65 secs EXE:/usr/local/lsws/lsphp74/bin/lsphp CMD:lsphp
Aug 7 01:32:07 ubuntu lfd[317826]: Suspicious Process PID:317799 PPID:317755 User:nabna2000 Uptime:66 secs EXE:/usr/local/lsws/lsphp74/bin/lsphp CMD:lsphp
Aug 7 01:34:07 ubuntu lfd[317854]: Suspicious Process PID:317838 PPID:317755 User:nabna2000 Uptime:67 secs EXE:/usr/local/lsws/lsphp74/bin/lsphp CMD:lsphp:/home/mysite.com/public_html/index.php
Aug 7 01:39:07 ubuntu lfd[318014]: Suspicious Process PID:317924 PPID:317755 User:nabna2000 Uptime:67 secs EXE:/usr/local/lsws/lsphp74/bin/lsphp CMD:lsphp
Aug 7 01:44:08 ubuntu lfd[318114]: Suspicious Process PID:318082 PPID:318043 User:nabna2000 Uptime:67 secs EXE:/usr/local/lsws/lsphp74/bin/lsphp CMD:lsphp
Aug 7 01:49:08 ubuntu lfd[318210]: Suspicious Process PID:318181 PPID:318043 User:nabna2000 Uptime:67 secs EXE:/usr/local/lsws/lsphp74/bin/lsphp CMD:lsphp:/home/mysite.com/public_html/wp-load.php
Aug 7 01:54:08 ubuntu lfd[318307]: Suspicious Process PID:318281 PPID:318043 User:nabna2000 Uptime:67 secs EXE:/usr/local/lsws/lsphp74/bin/lsphp CMD:lsphp:/home/mysite.com/public_html/wp-load.php
Aug 7 01:55:08 ubuntu lfd[318323]: Suspicious Process PID:318298 PPID:318043 User:nabna2000 Uptime:80 secs EXE:/usr/local/lsws/lsphp74/bin/lsphp CMD:lsphp:/home/mysite.com/public_html/index.php
Aug 7 01:59:08 ubuntu lfd[318388]: Suspicious Process PID:318361 PPID:318043 User:nabna2000 Uptime:67 secs EXE:/usr/local/lsws/lsphp74/bin/lsphp CMD:lsphp
Aug 7 02:03:08 ubuntu lfd[318590]: Suspicious Process PID:636 PPID:636 User:redis Uptime:990627 secs EXE:/usr/bin/redis-check-rdb CMD:/usr/bin/redis-server 127.0.0.1:6379
Aug 7 02:04:09 ubuntu lfd[318616]: Suspicious Process PID:318580 PPID:318043 User:nabna2000 Uptime:67 secs EXE:/usr/local/lsws/lsphp74/bin/lsphp CMD:lsphp:/home/mysite.com/public_html/wp-load.php
Aug 7 02:14:09 ubuntu lfd[318861]: Suspicious Process PID:318844 PPID:318834 User:nabna2000 Uptime:69 secs EXE:/usr/local/lsws/lsphp74/bin/lsphp CMD:lsphp:/home/mysite.com/public_html/wp-load.php
Aug 7 02:19:09 ubuntu lfd[318941]: Suspicious Process PID:318918 PPID:318834 User:nabna2000 Uptime:69 secs EXE:/usr/local/lsws/lsphp74/bin/lsphp CMD:lsphp:/home/mysite.com/public_html/wp-load.php
Aug 7 02:39:10 ubuntu lfd[319354]: Suspicious Process PID:319266 PPID:319265 User:nabna2000 Uptime:69 secs EXE:/usr/local/lsws/lsphp74/bin/lsphp CMD:lsphp:/home/mysite.com/public_html/wp-load.php
Aug 7 02:49:10 ubuntu lfd[319558]: Suspicious Process PID:319534 PPID:319265 User:nabna2000 Uptime:69 secs EXE:/usr/local/lsws/lsphp74/bin/lsphp CMD:lsphp:/home/mysite.com/public_html/wp-load.php
Aug 7 03:03:11 ubuntu lfd[319830]: Suspicious Process PID:636 PPID:636 User:redis Uptime:994229 secs EXE:/usr/bin/redis-check-rdb CMD:/usr/bin/redis-server 127.0.0.1:6379
Aug 7 03:04:11 ubuntu lfd[319846]: Suspicious Process PID:319814 PPID:319779 User:nabna2000 Uptime:70 secs EXE:/usr/local/lsws/lsphp74/bin/lsphp CMD:lsphp:/home/mysite.com/public_html/wp-load.php
Aug 7 03:08:11 ubuntu lfd[319915]: Suspicious Process PID:318539 PPID:318536 User:lscpd Uptime:4072 secs EXE:/usr/local/lscp/bin/lscpd CMD:lscpd (#01)
Aug 7 03:09:11 ubuntu lfd[320000]: Suspicious Process PID:319905 PPID:319901 User:nabna2000 Uptime:71 secs EXE:/usr/local/lsws/lsphp74/bin/lsphp CMD:lsphp
Aug 7 03:14:11 ubuntu lfd[320091]: Suspicious Process PID:320064 PPID:319901 User:nabna2000 Uptime:71 secs EXE:/usr/local/lsws/lsphp74/bin/lsphp CMD:lsphp:/home/mysite.com/public_html/wp-load.php
Aug 7 03:19:12 ubuntu lfd[320174]: Suspicious Process PID:320150 PPID:320144 User:nabna2000 Uptime:71 secs EXE:/usr/local/lsws/lsphp74/bin/lsphp CMD:lsphp:/home/mysite.com/public_html/wp-load.php
Aug 7 03:29:12 ubuntu lfd[320334]: Suspicious Process PID:320312 PPID:320311 User:nabna2000 Uptime:71 secs EXE:/usr/local/lsws/lsphp74/bin/lsphp CMD:lsphp:/home/mysite.com/public_html/wp-load.php
Aug 7 03:34:12 ubuntu lfd[320441]: Suspicious Process PID:320411 PPID:320311 User:nabna2000 Uptime:71 secs EXE:/usr/local/lsws/lsphp74/bin/lsphp CMD:lsphp:/home/mysite.com/public_html/wp-load.php
Aug 7 03:44:13 ubuntu lfd[320715]: Suspicious Process PID:320687 PPID:320675 User:nabna2000 Uptime:72 secs EXE:/usr/local/lsws/lsphp74/bin/lsphp CMD:lsphp:/home/mysite.com/public_html/wp-load.php
Aug 7 03:49:13 ubuntu lfd[320797]: Suspicious Process PID:320770 PPID:320675 User:nabna2000 Uptime:72 secs EXE:/usr/local/lsws/lsphp74/bin/lsphp CMD:lsphp
Aug 7 03:54:13 ubuntu lfd[320897]: Suspicious Process PID:320864 PPID:320834 User:nabna2000 Uptime:72 secs EXE:/usr/local/lsws/lsphp74/bin/lsphp CMD:lsphp:/home/mysite.com/public_html/wp-load.php
Aug 7 03:59:13 ubuntu lfd[320995]: Suspicious Process PID:320971 PPID:320969 User:nabna2000 Uptime:72 secs EXE:/usr/local/lsws/lsphp74/bin/lsphp CMD:lsphp:/home/mysite.com/public_html/wp-load.php
Aug 7 04:03:13 ubuntu lfd[321093]: Suspicious Process PID:636 PPID:636 User:redis Uptime:997832 secs EXE:/usr/bin/redis-check-rdb CMD:/usr/bin/redis-server 127.0.0.1:6379
Aug 7 04:08:14 ubuntu lfd[321172]: Suspicious Process PID:321154 PPID:320969 User:nabna2000 Uptime:66 secs EXE:/usr/local/lsws/lsphp74/bin/lsphp CMD:lsphp:/home/mysite.com/public_html/index.php
Aug 7 04:09:14 ubuntu lfd[321255]: Suspicious Process PID:321165 PPID:320969 User:nabna2000 Uptime:73 secs EXE:/usr/local/lsws/lsphp74/bin/lsphp CMD:lsphp:/home/mysite.com/public_html/wp-load.php
Aug 7 04:14:14 ubuntu lfd[321341]: Suspicious Process PID:321315 PPID:320969 User:nabna2000 Uptime:73 secs EXE:/usr/local/lsws/lsphp74/bin/lsphp CMD:lsphp:/home/mysite.com/public_html/wp-load.php
Aug 7 04:19:14 ubuntu lfd[321436]: Suspicious Process PID:321410 PPID:321368 User:nabna2000 Uptime:74 secs EXE:/usr/local/lsws/lsphp74/bin/lsphp CMD:lsphp:/home/mysite.com/public_html/wp-load.php
Aug 7 04:24:14 ubuntu lfd[321552]: Suspicious Process PID:321522 PPID:321368 User:nabna2000 Uptime:74 secs EXE:/usr/local/lsws/lsphp74/bin/lsphp CMD:lsphp
Aug 7 04:39:15 ubuntu lfd[321902]: Suspicious Process PID:321814 PPID:321368 User:nabna2000 Uptime:74 secs EXE:/usr/local/lsws/lsphp74/bin/lsphp CMD:lsphp:/home/mysite.com/public_html/wp-load.php
Aug 7 04:40:15 ubuntu lfd[321921]: Suspicious Process PID:321897 PPID:321368 User:nabna2000 Uptime:72 secs EXE:/usr/local/lsws/lsphp74/bin/lsphp CMD:lsphp:/home/mysite.com/public_html/index.php
Aug 7 04:49:15 ubuntu lfd[322073]: Suspicious Process PID:322048 PPID:321368 User:nabna2000 Uptime:75 secs EXE:/usr/local/lsws/lsphp74/bin/lsphp CMD:lsphp:/home/mysite.com/public_html/wp-load.php
Aug 7 05:18:17 ubuntu lfd[322684]: Suspicious Process PID:636 PPID:636 User:redis Uptime:1002335 secs EXE:/usr/bin/redis-check-rdb CMD:/usr/bin/redis-server 127.0.0.1:6379
Aug 7 05:47:18 ubuntu lfd[323237]: Suspicious Process PID:323221 PPID:323220 User:nabna2000 Uptime:71 secs EXE:/usr/local/lsws/lsphp74/bin/lsphp CMD:lsphp:/home/mysite.com/public_html/index.php
Aug 7 06:19:19 ubuntu lfd[323879]: Suspicious Process PID:636 PPID:636 User:redis Uptime:1005998 secs EXE:/usr/bin/redis-check-rdb CMD:/usr/bin/redis-server 127.0.0.1:6379
Aug 7 07:19:22 ubuntu lfd[325345]: Suspicious Process PID:636 PPID:636 User:redis Uptime:1009600 secs EXE:/usr/bin/redis-check-rdb CMD:/usr/bin/redis-server 127.0.0.1:6379
Aug 7 08:21:24 ubuntu lfd[326617]: Suspicious Process PID:636 PPID:636 User:redis Uptime:1013323 secs EXE:/usr/bin/redis-check-rdb CMD:/usr/bin/redis-server 127.0.0.1:6379
Aug 7 09:27:27 ubuntu lfd[327899]: Suspicious Process PID:636 PPID:636 User:redis Uptime:1017286 secs EXE:/usr/bin/redis-check-rdb CMD:/usr/bin/redis-server 127.0.0.1:6379
Aug 7 10:29:30 ubuntu lfd[329104]: Suspicious Process PID:636 PPID:636 User:redis Uptime:1021008 secs EXE:/usr/bin/redis-check-rdb CMD:/usr/bin/redis-server 127.0.0.1:6379
Aug 7 11:53:34 ubuntu lfd[330740]: Suspicious Process PID:636 PPID:636 User:redis Uptime:1026052 secs EXE:/usr/bin/redis-check-rdb CMD:/usr/bin/redis-server 127.0.0.1:6379
Aug 7 13:02:37 ubuntu lfd[332213]: Suspicious Process PID:636 PPID:636 User:redis Uptime:1030195 secs EXE:/usr/bin/redis-check-rdb CMD:/usr/bin/redis-server 127.0.0.1:6379
Aug 7 14:08:40 ubuntu lfd[333502]: Suspicious Process PID:636 PPID:636 User:redis Uptime:1034158 secs EXE:/usr/bin/redis-check-rdb CMD:/usr/bin/redis-server 127.0.0.1:6379
Aug 7 15:10:43 ubuntu lfd[334825]: Suspicious Process PID:636 PPID:636 User:redis Uptime:1037881 secs EXE:/usr/bin/redis-check-rdb CMD:/usr/bin/redis-server 127.0.0.1:6379
Aug 7 16:04:45 ubuntu lfd[336233]: Suspicious Process PID:318539 PPID:318536 User:lscpd Uptime:50666 secs EXE:/usr/local/lscp/bin/lscpd CMD:lscpd (#01)
Aug 7 16:12:45 ubuntu lfd[336507]: Suspicious Process PID:636 PPID:636 User:redis Uptime:1041604 secs EXE:/usr/bin/redis-check-rdb CMD:/usr/bin/redis-server 127.0.0.1:6379